From 756a74cf27253e4f0a66a6557f091453f68e72c3 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Wed, 21 Mar 2018 20:43:10 +1300
Subject: [PATCH 01/27] winbindd: Add a cache of the samr and lsa handles for
 the passdb domain

This domain is very close, in AD DC configurations over a internal ncacn_np pipe
and otherwise in the same process via C linking.  It is however very expensive
to re-create the binding handle per SID->name lookup, so keep a cache.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
---
 source3/winbindd/winbindd_samr.c | 267 +++++++++++++++++++++++----------------
 1 file changed, 159 insertions(+), 108 deletions(-)

diff --git a/source3/winbindd/winbindd_samr.c b/source3/winbindd/winbindd_samr.c
index aedb77bdee9..da54d697909 100644
--- a/source3/winbindd/winbindd_samr.c
+++ b/source3/winbindd/winbindd_samr.c
@@ -40,6 +40,20 @@
 #undef DBGC_CLASS
 #define DBGC_CLASS DBGC_WINBIND
 
+/*
+ * The other end of this won't go away easily, so we can trust it
+ *
+ * It is either a long-lived process with the same lifetime as
+ * winbindd or a part of this process
+ */
+struct winbind_internal_pipes {
+	struct rpc_pipe_client *samr_pipe;
+	struct policy_handle samr_domain_hnd;
+	struct rpc_pipe_client *lsa_pipe;
+	struct policy_handle lsa_hnd;
+};
+
+
 NTSTATUS open_internal_samr_conn(TALLOC_CTX *mem_ctx,
 				 struct winbindd_domain *domain,
 				 struct rpc_pipe_client **samr_pipe,
@@ -101,6 +115,70 @@ NTSTATUS open_internal_lsa_conn(TALLOC_CTX *mem_ctx,
 	return status;
 }
 
+
+static NTSTATUS open_cached_internal_pipe_conn(
+	struct winbindd_domain *domain,
+	struct rpc_pipe_client **samr_pipe,
+	struct policy_handle *samr_domain_hnd,
+	struct rpc_pipe_client **lsa_pipe,
+	struct policy_handle *lsa_hnd)
+{
+	struct winbind_internal_pipes *internal_pipes = NULL;
+
+	if (domain->private_data == NULL) {
+		TALLOC_CTX *frame = talloc_stackframe();
+		NTSTATUS status;
+
+		internal_pipes = talloc_zero(frame,
+					     struct winbind_internal_pipes);
+
+		status = open_internal_samr_conn(
+			internal_pipes,
+			domain,
+			&internal_pipes->samr_pipe,
+			&internal_pipes->samr_domain_hnd);
+		if (!NT_STATUS_IS_OK(status)) {
+			TALLOC_FREE(frame);
+			return status;
+		}
+
+		status = open_internal_lsa_conn(internal_pipes,
+						&internal_pipes->lsa_pipe,
+						&internal_pipes->lsa_hnd);
+
+		if (!NT_STATUS_IS_OK(status)) {
+			TALLOC_FREE(frame);
+			return status;
+		}
+
+		domain->private_data = talloc_move(domain, &internal_pipes);
+
+		TALLOC_FREE(frame);
+
+	}
+
+	internal_pipes = talloc_get_type_abort(
+		domain->private_data, struct winbind_internal_pipes);
+
+	if (samr_domain_hnd) {
+		*samr_domain_hnd = internal_pipes->samr_domain_hnd;
+	}
+
+	if (samr_pipe) {
+		*samr_pipe = internal_pipes->samr_pipe;
+	}
+
+	if (lsa_hnd) {
+		*lsa_hnd = internal_pipes->lsa_hnd;
+	}
+
+	if (lsa_pipe) {
+		*lsa_pipe = internal_pipes->lsa_pipe;
+	}
+
+	return NT_STATUS_OK;
+}
+
 /*********************************************************************
  SAM specific functions.
 *********************************************************************/
@@ -116,8 +194,7 @@ static NTSTATUS sam_enum_dom_groups(struct winbindd_domain *domain,
 	struct wb_acct_info *info = NULL;
 	uint32_t num_info = 0;
 	TALLOC_CTX *tmp_ctx;
-	NTSTATUS status, result;
-	struct dcerpc_binding_handle *b = NULL;
+	NTSTATUS status;
 
 	DEBUG(3,("sam_enum_dom_groups\n"));
 
@@ -130,20 +207,24 @@ static NTSTATUS sam_enum_dom_groups(struct winbindd_domain *domain,
 		return NT_STATUS_NO_MEMORY;
 	}
 
-	status = open_internal_samr_conn(tmp_ctx, domain, &samr_pipe, &dom_pol);
+	status = open_cached_internal_pipe_conn(domain,
+						&samr_pipe,
+						&dom_pol,
+						NULL,
+						NULL);
 	if (!NT_STATUS_IS_OK(status)) {
-		goto error;
+		TALLOC_FREE(tmp_ctx);
+		return status;
 	}
 
-	b = samr_pipe->binding_handle;
-
 	status = rpc_enum_dom_groups(tmp_ctx,
 				     samr_pipe,
 				     &dom_pol,
 				     &num_info,
 				     &info);
 	if (!NT_STATUS_IS_OK(status)) {
-		goto error;
+		TALLOC_FREE(tmp_ctx);
+		return status;
 	}
 
 	if (pnum_info) {
@@ -154,10 +235,6 @@ static NTSTATUS sam_enum_dom_groups(struct winbindd_domain *domain,
 		*pinfo = talloc_move(mem_ctx, &info);
 	}
 
-error:
-	if (b && is_valid_policy_hnd(&dom_pol)) {
-		dcerpc_samr_Close(b, mem_ctx, &dom_pol, &result);
-	}
 	TALLOC_FREE(tmp_ctx);
 	return status;
 }
@@ -171,8 +248,7 @@ static NTSTATUS sam_query_user_list(struct winbindd_domain *domain,
 	struct policy_handle dom_pol = { 0 };
 	uint32_t *rids = NULL;
 	TALLOC_CTX *tmp_ctx;
-	NTSTATUS status, result;
-	struct dcerpc_binding_handle *b = NULL;
+	NTSTATUS status;
 
 	DEBUG(3,("samr_query_user_list\n"));
 
@@ -181,13 +257,15 @@ static NTSTATUS sam_query_user_list(struct winbindd_domain *domain,
 		return NT_STATUS_NO_MEMORY;
 	}
 
-	status = open_internal_samr_conn(tmp_ctx, domain, &samr_pipe, &dom_pol);
+	status = open_cached_internal_pipe_conn(domain,
+						&samr_pipe,
+						&dom_pol,
+						NULL,
+						NULL);
 	if (!NT_STATUS_IS_OK(status)) {
 		goto done;
 	}
 
-	b = samr_pipe->binding_handle;
-
 	status = rpc_query_user_list(tmp_ctx,
 				     samr_pipe,
 				     &dom_pol,
@@ -202,10 +280,6 @@ static NTSTATUS sam_query_user_list(struct winbindd_domain *domain,
 	}
 
 done:
-	if (b && is_valid_policy_hnd(&dom_pol)) {
-		dcerpc_samr_Close(b, mem_ctx, &dom_pol, &result);
-	}
-
 	TALLOC_FREE(rids);
 	TALLOC_FREE(tmp_ctx);
 	return status;
@@ -221,8 +295,7 @@ static NTSTATUS sam_trusted_domains(struct winbindd_domain *domain,
 	struct netr_DomainTrust *trusts = NULL;
 	uint32_t num_trusts = 0;
 	TALLOC_CTX *tmp_ctx;
-	NTSTATUS status, result;
-	struct dcerpc_binding_handle *b = NULL;
+	NTSTATUS status;
 
 	DEBUG(3,("samr: trusted domains\n"));
 
@@ -235,13 +308,15 @@ static NTSTATUS sam_trusted_domains(struct winbindd_domain *domain,
 		return NT_STATUS_NO_MEMORY;
 	}
 
-	status = open_internal_lsa_conn(tmp_ctx, &lsa_pipe, &lsa_policy);
+	status = open_cached_internal_pipe_conn(domain,
+						NULL,
+						NULL,
+						&lsa_pipe,
+						&lsa_policy);
 	if (!NT_STATUS_IS_OK(status)) {
 		goto done;
 	}
 
-	b = lsa_pipe->binding_handle;
-
 	status = rpc_trusted_domains(tmp_ctx,
 				     lsa_pipe,
 				     &lsa_policy,
@@ -257,10 +332,6 @@ static NTSTATUS sam_trusted_domains(struct winbindd_domain *domain,
 	}
 
 done:
-	if (b && is_valid_policy_hnd(&lsa_policy)) {
-		dcerpc_lsa_Close(b, mem_ctx, &lsa_policy, &result);
-	}
-
 	TALLOC_FREE(tmp_ctx);
 	return status;
 }
@@ -284,8 +355,7 @@ static NTSTATUS sam_lookup_groupmem(struct winbindd_domain *domain,
 	uint32_t *name_types = NULL;
 
 	TALLOC_CTX *tmp_ctx;
-	NTSTATUS status, result;
-	struct dcerpc_binding_handle *b = NULL;
+	NTSTATUS status;
 
 	DEBUG(3,("sam_lookup_groupmem\n"));
 
@@ -304,13 +374,15 @@ static NTSTATUS sam_lookup_groupmem(struct winbindd_domain *domain,
 		return NT_STATUS_NO_MEMORY;
 	}
 
-	status = open_internal_samr_conn(tmp_ctx, domain, &samr_pipe, &dom_pol);
+	status = open_cached_internal_pipe_conn(domain,
+						&samr_pipe,
+						&dom_pol,
+						NULL,
+						NULL);
 	if (!NT_STATUS_IS_OK(status)) {
 		goto done;
 	}
 
-	b = samr_pipe->binding_handle;
-
 	status = rpc_lookup_groupmem(tmp_ctx,
 				     samr_pipe,
 				     &dom_pol,
@@ -340,10 +412,6 @@ static NTSTATUS sam_lookup_groupmem(struct winbindd_domain *domain,
 	}
 
 done:
-	if (b && is_valid_policy_hnd(&dom_pol)) {
-		dcerpc_samr_Close(b, mem_ctx, &dom_pol, &result);
-	}
-
 	TALLOC_FREE(tmp_ctx);
 	return status;
 }
@@ -398,8 +466,7 @@ static NTSTATUS sam_enum_local_groups(struct winbindd_domain *domain,
 	struct wb_acct_info *info = NULL;
 	uint32_t num_info = 0;
 	TALLOC_CTX *tmp_ctx;
-	NTSTATUS status, result;
-	struct dcerpc_binding_handle *b = NULL;
+	NTSTATUS status;
 
 	DEBUG(3,("samr: enum local groups\n"));
 
@@ -412,13 +479,15 @@ static NTSTATUS sam_enum_local_groups(struct winbindd_domain *domain,
 		return NT_STATUS_NO_MEMORY;
 	}
 
-	status = open_internal_samr_conn(tmp_ctx, domain, &samr_pipe, &dom_pol);
+	status = open_cached_internal_pipe_conn(domain,
+						&samr_pipe,
+						&dom_pol,
+						NULL,
+						NULL);
 	if (!NT_STATUS_IS_OK(status)) {
 		goto done;
 	}
 
-	b = samr_pipe->binding_handle;
-
 	status = rpc_enum_local_groups(mem_ctx,
 				       samr_pipe,
 				       &dom_pol,
@@ -437,10 +506,6 @@ static NTSTATUS sam_enum_local_groups(struct winbindd_domain *domain,
 	}
 
 done:
-	if (b && is_valid_policy_hnd(&dom_pol)) {
-		dcerpc_samr_Close(b, mem_ctx, &dom_pol, &result);
-	}
-
 	TALLOC_FREE(tmp_ctx);
 	return status;
 }
@@ -459,8 +524,7 @@ static NTSTATUS sam_name_to_sid(struct winbindd_domain *domain,
 	struct dom_sid sid;
 	enum lsa_SidType type;
 	TALLOC_CTX *tmp_ctx;
-	NTSTATUS status, result;
-	struct dcerpc_binding_handle *b = NULL;
+	NTSTATUS status;
 
 	DEBUG(3,("sam_name_to_sid\n"));
 
@@ -469,13 +533,15 @@ static NTSTATUS sam_name_to_sid(struct winbindd_domain *domain,
 		return NT_STATUS_NO_MEMORY;
 	}
 
-	status = open_internal_lsa_conn(tmp_ctx, &lsa_pipe, &lsa_policy);
+	status = open_cached_internal_pipe_conn(domain,
+						NULL,
+						NULL,
+						&lsa_pipe,
+						&lsa_policy);
 	if (!NT_STATUS_IS_OK(status)) {
 		goto done;
 	}
 
-	b = lsa_pipe->binding_handle;
-
 	status = rpc_name_to_sid(tmp_ctx,
 				 lsa_pipe,
 				 &lsa_policy,
@@ -496,10 +562,6 @@ static NTSTATUS sam_name_to_sid(struct winbindd_domain *domain,
 	}
 
 done:
-	if (b && is_valid_policy_hnd(&lsa_policy)) {
-		dcerpc_lsa_Close(b, mem_ctx, &lsa_policy, &result);
-	}
-
 	TALLOC_FREE(tmp_ctx);
 	return status;
 }
@@ -518,8 +580,7 @@ static NTSTATUS sam_sid_to_name(struct winbindd_domain *domain,
 	char *name = NULL;
 	enum lsa_SidType type;
 	TALLOC_CTX *tmp_ctx;
-	NTSTATUS status, result;
-	struct dcerpc_binding_handle *b = NULL;
+	NTSTATUS status;
 
 	DEBUG(3,("sam_sid_to_name\n"));
 
@@ -543,13 +604,15 @@ static NTSTATUS sam_sid_to_name(struct winbindd_domain *domain,
 		return NT_STATUS_NO_MEMORY;
 	}
 
-	status = open_internal_lsa_conn(tmp_ctx, &lsa_pipe, &lsa_policy);
+	status = open_cached_internal_pipe_conn(domain,
+						NULL,
+						NULL,
+						&lsa_pipe,
+						&lsa_policy);
 	if (!NT_STATUS_IS_OK(status)) {
 		goto done;
 	}
 
-	b = lsa_pipe->binding_handle;
-
 	status = rpc_sid_to_name(tmp_ctx,
 				 lsa_pipe,
 				 &lsa_policy,
@@ -572,9 +635,6 @@ static NTSTATUS sam_sid_to_name(struct winbindd_domain *domain,
 	}
 
 done:
-	if (b && is_valid_policy_hnd(&lsa_policy)) {
-		dcerpc_lsa_Close(b, mem_ctx, &lsa_policy, &result);
-	}
 
 	TALLOC_FREE(tmp_ctx);
 	return status;
@@ -595,8 +655,7 @@ static NTSTATUS sam_rids_to_names(struct winbindd_domain *domain,
 	char *domain_name = NULL;
 	char **names = NULL;
 	TALLOC_CTX *tmp_ctx;
-	NTSTATUS status, result;
-	struct dcerpc_binding_handle *b = NULL;
+	NTSTATUS status;
 
 	DEBUG(3,("sam_rids_to_names for %s\n", domain->name));
 
@@ -616,13 +675,15 @@ static NTSTATUS sam_rids_to_names(struct winbindd_domain *domain,
 		return NT_STATUS_NO_MEMORY;
 	}
 
-	status = open_internal_lsa_conn(tmp_ctx, &lsa_pipe, &lsa_policy);
+	status = open_cached_internal_pipe_conn(domain,
+						NULL,
+						NULL,
+						&lsa_pipe,
+						&lsa_policy);
 	if (!NT_STATUS_IS_OK(status)) {
 		goto done;
 	}
 
-	b = lsa_pipe->binding_handle;
-
 	status = rpc_rids_to_names(tmp_ctx,
 				   lsa_pipe,
 				   &lsa_policy,
@@ -650,10 +711,6 @@ static NTSTATUS sam_rids_to_names(struct winbindd_domain *domain,
 	}
 
 done:
-	if (b && is_valid_policy_hnd(&lsa_policy)) {
-		dcerpc_lsa_Close(b, mem_ctx, &lsa_policy, &result);
-	}
-
 	TALLOC_FREE(tmp_ctx);
 	return status;
 }
@@ -676,7 +733,11 @@ static NTSTATUS sam_lockout_policy(struct winbindd_domain *domain,
 		return NT_STATUS_NO_MEMORY;
 	}
 
-	status = open_internal_samr_conn(tmp_ctx, domain, &samr_pipe, &dom_pol);
+	status = open_cached_internal_pipe_conn(domain,
+						&samr_pipe,
+						&dom_pol,
+						NULL,
+						NULL);
 	if (!NT_STATUS_IS_OK(status)) {
 		goto error;
 	}
@@ -700,10 +761,6 @@ static NTSTATUS sam_lockout_policy(struct winbindd_domain *domain,
 	*lockout_policy = info->info12;
 
 error:
-	if (b && is_valid_policy_hnd(&dom_pol)) {
-		dcerpc_samr_Close(b, mem_ctx, &dom_pol, &result);
-	}
-
 	TALLOC_FREE(tmp_ctx);
 	return status;
 }
@@ -726,7 +783,11 @@ static NTSTATUS sam_password_policy(struct winbindd_domain *domain,
 		return NT_STATUS_NO_MEMORY;
 	}
 
-	status = open_internal_samr_conn(tmp_ctx, domain, &samr_pipe, &dom_pol);
+	status = open_cached_internal_pipe_conn(domain,
+						&samr_pipe,
+						&dom_pol,
+						NULL,
+						NULL);
 	if (!NT_STATUS_IS_OK(status)) {
 		goto error;
 	}
@@ -750,10 +811,6 @@ static NTSTATUS sam_password_policy(struct winbindd_domain *domain,
 	*passwd_policy = info->info1;
 
 error:
-	if (b && is_valid_policy_hnd(&dom_pol)) {
-		dcerpc_samr_Close(b, mem_ctx, &dom_pol, &result);
-	}
-
 	TALLOC_FREE(tmp_ctx);
 	return status;
 }
@@ -770,8 +827,7 @@ static NTSTATUS sam_lookup_usergroups(struct winbindd_domain *domain,
 	struct dom_sid *user_grpsids = NULL;
 	uint32_t num_groups = 0;
 	TALLOC_CTX *tmp_ctx;
-	NTSTATUS status, result;
-	struct dcerpc_binding_handle *b = NULL;
+	NTSTATUS status;
 
 	DEBUG(3,("sam_lookup_usergroups\n"));
 
@@ -786,13 +842,15 @@ static NTSTATUS sam_lookup_usergroups(struct winbindd_domain *domain,
 		return NT_STATUS_NO_MEMORY;
 	}
 
-	status = open_internal_samr_conn(tmp_ctx, domain, &samr_pipe, &dom_pol);
+	status = open_cached_internal_pipe_conn(domain,
+						&samr_pipe,
+						&dom_pol,
+						NULL,
+						NULL);
 	if (!NT_STATUS_IS_OK(status)) {
 		goto done;
 	}
 
-	b = samr_pipe->binding_handle;
-
 	status = rpc_lookup_usergroups(tmp_ctx,
 				       samr_pipe,
 				       &dom_pol,
@@ -813,9 +871,6 @@ static NTSTATUS sam_lookup_usergroups(struct winbindd_domain *domain,
 	}
 
 done:
-	if (b && is_valid_policy_hnd(&dom_pol)) {
-		dcerpc_samr_Close(b, mem_ctx, &dom_pol, &result);
-	}
 
 	TALLOC_FREE(tmp_ctx);
 	return status;
@@ -833,8 +888,7 @@ static NTSTATUS sam_lookup_useraliases(struct winbindd_domain *domain,
 	uint32_t num_aliases = 0;
 	uint32_t *alias_rids = NULL;
 	TALLOC_CTX *tmp_ctx;
-	NTSTATUS status, result;
-	struct dcerpc_binding_handle *b = NULL;
+	NTSTATUS status;
 
 	DEBUG(3,("sam_lookup_useraliases\n"));
 
@@ -847,13 +901,15 @@ static NTSTATUS sam_lookup_useraliases(struct winbindd_domain *domain,
 		return NT_STATUS_NO_MEMORY;
 	}
 
-	status = open_internal_samr_conn(tmp_ctx, domain, &samr_pipe, &dom_pol);
+	status = open_cached_internal_pipe_conn(domain,
+						&samr_pipe,
+						&dom_pol,
+						NULL,
+						NULL);
 	if (!NT_STATUS_IS_OK(status)) {
 		goto done;
 	}
 
-	b = samr_pipe->binding_handle;
-
 	status = rpc_lookup_useraliases(tmp_ctx,
 					samr_pipe,
 					&dom_pol,
@@ -874,9 +930,6 @@ static NTSTATUS sam_lookup_useraliases(struct winbindd_domain *domain,
 	}
 
 done:
-	if (b && is_valid_policy_hnd(&dom_pol)) {
-		dcerpc_samr_Close(b, mem_ctx, &dom_pol, &result);
-	}
 
 	TALLOC_FREE(tmp_ctx);
 	return status;
@@ -890,8 +943,7 @@ static NTSTATUS sam_sequence_number(struct winbindd_domain *domain,
 	struct policy_handle dom_pol = { 0 };
 	uint32_t seq = DOM_SEQUENCE_NONE;
 	TALLOC_CTX *tmp_ctx;
-	NTSTATUS status, result;
-	struct dcerpc_binding_handle *b = NULL;
+	NTSTATUS status;
 
 	DEBUG(3,("samr: sequence number\n"));
 
@@ -904,13 +956,15 @@ static NTSTATUS sam_sequence_number(struct winbindd_domain *domain,
 		return NT_STATUS_NO_MEMORY;
 	}
 
-	status = open_internal_samr_conn(tmp_ctx, domain, &samr_pipe, &dom_pol);
+	status = open_cached_internal_pipe_conn(domain,
+						&samr_pipe,
+						&dom_pol,
+						NULL,
+						NULL);
 	if (!NT_STATUS_IS_OK(status)) {
 		goto done;
 	}
 
-	b = samr_pipe->binding_handle;
-
 	status = rpc_sequence_number(tmp_ctx,
 				     samr_pipe,
 				     &dom_pol,
@@ -923,11 +977,8 @@ static NTSTATUS sam_sequence_number(struct winbindd_domain *domain,
 	if (pseq) {
 		*pseq = seq;
 	}
-done:
-	if (b && is_valid_policy_hnd(&dom_pol)) {
-		dcerpc_samr_Close(b, tmp_ctx, &dom_pol, &result);
-	}
 
+done:
 	TALLOC_FREE(tmp_ctx);
 	return status;
 }

From 630f1fd8548b5960aa6bb5bec5bb0bdf6a8a9e70 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Wed, 21 Mar 2018 20:44:31 +1300
Subject: [PATCH 02/27] winbindd: Do re-connect if the RPC call fails in the
 passdb case

This is very, very unlikely but possible as in the AD case the RPC server is in
another process that may eventually be able to restart.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
---
 source3/winbindd/winbindd_samr.c | 128 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 128 insertions(+)

diff --git a/source3/winbindd/winbindd_samr.c b/source3/winbindd/winbindd_samr.c
index da54d697909..31720d54997 100644
--- a/source3/winbindd/winbindd_samr.c
+++ b/source3/winbindd/winbindd_samr.c
@@ -28,6 +28,7 @@
 #include "winbindd_rpc.h"
 #include "lib/util_unixsids.h"
 #include "rpc_client/rpc_client.h"
+#include "rpc_client/cli_pipe.h"
 #include "../librpc/gen_ndr/ndr_samr_c.h"
 #include "rpc_client/cli_samr.h"
 #include "../librpc/gen_ndr/ndr_lsa_c.h"
@@ -179,6 +180,32 @@ static NTSTATUS open_cached_internal_pipe_conn(
 	return NT_STATUS_OK;
 }
 
+static bool reset_connection_on_error(struct winbindd_domain *domain,
+				      struct rpc_pipe_client *p,
+				      NTSTATUS status)
+{
+	struct winbind_internal_pipes *internal_pipes = NULL;
+
+	internal_pipes = talloc_get_type_abort(
+		domain->private_data, struct winbind_internal_pipes);
+
+	if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
+	    NT_STATUS_EQUAL(status, NT_STATUS_IO_DEVICE_ERROR))
+	{
+		TALLOC_FREE(internal_pipes);
+		domain->private_data = NULL;
+		return true;
+	}
+
+	if (!rpccli_is_connected(p)) {
+		TALLOC_FREE(internal_pipes);
+		domain->private_data = NULL;
+		return true;
+	}
+
+	return false;
+}
+
 /*********************************************************************
  SAM specific functions.
 *********************************************************************/
@@ -195,6 +222,7 @@ static NTSTATUS sam_enum_dom_groups(struct winbindd_domain *domain,
 	uint32_t num_info = 0;
 	TALLOC_CTX *tmp_ctx;
 	NTSTATUS status;
+	bool retry = false;
 
 	DEBUG(3,("sam_enum_dom_groups\n"));
 
@@ -207,6 +235,7 @@ static NTSTATUS sam_enum_dom_groups(struct winbindd_domain *domain,
 		return NT_STATUS_NO_MEMORY;
 	}
 
+again:
 	status = open_cached_internal_pipe_conn(domain,
 						&samr_pipe,
 						&dom_pol,
@@ -222,6 +251,12 @@ static NTSTATUS sam_enum_dom_groups(struct winbindd_domain *domain,
 				     &dom_pol,
 				     &num_info,
 				     &info);
+
+	if (!retry && reset_connection_on_error(domain, samr_pipe, status)) {
+		retry = true;
+		goto again;
+	}
+
 	if (!NT_STATUS_IS_OK(status)) {
 		TALLOC_FREE(tmp_ctx);
 		return status;
@@ -249,6 +284,7 @@ static NTSTATUS sam_query_user_list(struct winbindd_domain *domain,
 	uint32_t *rids = NULL;
 	TALLOC_CTX *tmp_ctx;
 	NTSTATUS status;
+	bool retry = false;
 
 	DEBUG(3,("samr_query_user_list\n"));
 
@@ -257,6 +293,7 @@ static NTSTATUS sam_query_user_list(struct winbindd_domain *domain,
 		return NT_STATUS_NO_MEMORY;
 	}
 
+again:
 	status = open_cached_internal_pipe_conn(domain,
 						&samr_pipe,
 						&dom_pol,
@@ -271,6 +308,11 @@ static NTSTATUS sam_query_user_list(struct winbindd_domain *domain,
 				     &dom_pol,
 				     &domain->sid,
 				     &rids);
+	if (!retry && reset_connection_on_error(domain, samr_pipe, status)) {
+		retry = true;
+		goto again;
+	}
+
 	if (!NT_STATUS_IS_OK(status)) {
 		goto done;
 	}
@@ -296,6 +338,7 @@ static NTSTATUS sam_trusted_domains(struct winbindd_domain *domain,
 	uint32_t num_trusts = 0;
 	TALLOC_CTX *tmp_ctx;
 	NTSTATUS status;
+	bool retry = false;
 
 	DEBUG(3,("samr: trusted domains\n"));
 
@@ -308,6 +351,7 @@ static NTSTATUS sam_trusted_domains(struct winbindd_domain *domain,
 		return NT_STATUS_NO_MEMORY;
 	}
 
+again:
 	status = open_cached_internal_pipe_conn(domain,
 						NULL,
 						NULL,
@@ -322,6 +366,12 @@ static NTSTATUS sam_trusted_domains(struct winbindd_domain *domain,
 				     &lsa_policy,
 				     &num_trusts,
 				     &trusts);
+
+	if (!retry && reset_connection_on_error(domain, lsa_pipe, status)) {
+		retry = true;
+		goto again;
+	}
+
 	if (!NT_STATUS_IS_OK(status)) {
 		goto done;
 	}
@@ -356,6 +406,7 @@ static NTSTATUS sam_lookup_groupmem(struct winbindd_domain *domain,
 
 	TALLOC_CTX *tmp_ctx;
 	NTSTATUS status;
+	bool retry = false;
 
 	DEBUG(3,("sam_lookup_groupmem\n"));
 
@@ -374,6 +425,7 @@ static NTSTATUS sam_lookup_groupmem(struct winbindd_domain *domain,
 		return NT_STATUS_NO_MEMORY;
 	}
 
+again:
 	status = open_cached_internal_pipe_conn(domain,
 						&samr_pipe,
 						&dom_pol,
@@ -395,6 +447,11 @@ static NTSTATUS sam_lookup_groupmem(struct winbindd_domain *domain,
 				     &names,
 				     &name_types);
 
+	if (!retry && reset_connection_on_error(domain, samr_pipe, status)) {
+		retry = true;
+		goto again;
+	}
+
 	if (pnum_names) {
 		*pnum_names = num_names;
 	}
@@ -467,6 +524,7 @@ static NTSTATUS sam_enum_local_groups(struct winbindd_domain *domain,
 	uint32_t num_info = 0;
 	TALLOC_CTX *tmp_ctx;
 	NTSTATUS status;
+	bool retry = false;
 
 	DEBUG(3,("samr: enum local groups\n"));
 
@@ -479,6 +537,7 @@ static NTSTATUS sam_enum_local_groups(struct winbindd_domain *domain,
 		return NT_STATUS_NO_MEMORY;
 	}
 
+again:
 	status = open_cached_internal_pipe_conn(domain,
 						&samr_pipe,
 						&dom_pol,
@@ -492,7 +551,13 @@ static NTSTATUS sam_enum_local_groups(struct winbindd_domain *domain,
 				       samr_pipe,
 				       &dom_pol,
 				       &num_info,
+
 				       &info);
+	if (!retry && reset_connection_on_error(domain, samr_pipe, status)) {
+		retry = true;
+		goto again;
+	}
+
 	if (!NT_STATUS_IS_OK(status)) {
 		goto done;
 	}
@@ -525,6 +590,7 @@ static NTSTATUS sam_name_to_sid(struct winbindd_domain *domain,
 	enum lsa_SidType type;
 	TALLOC_CTX *tmp_ctx;
 	NTSTATUS status;
+	bool retry = false;
 
 	DEBUG(3,("sam_name_to_sid\n"));
 
@@ -533,6 +599,7 @@ static NTSTATUS sam_name_to_sid(struct winbindd_domain *domain,
 		return NT_STATUS_NO_MEMORY;
 	}
 
+again:
 	status = open_cached_internal_pipe_conn(domain,
 						NULL,
 						NULL,
@@ -550,6 +617,12 @@ static NTSTATUS sam_name_to_sid(struct winbindd_domain *domain,
 				 flags,
 				 &sid,
 				 &type);
+
+	if (!retry && reset_connection_on_error(domain, lsa_pipe, status)) {
+		retry = true;
+		goto again;
+	}
+
 	if (!NT_STATUS_IS_OK(status)) {
 		goto done;
 	}
@@ -581,6 +654,7 @@ static NTSTATUS sam_sid_to_name(struct winbindd_domain *domain,
 	enum lsa_SidType type;
 	TALLOC_CTX *tmp_ctx;
 	NTSTATUS status;
+	bool retry = false;
 
 	DEBUG(3,("sam_sid_to_name\n"));
 
@@ -604,6 +678,7 @@ static NTSTATUS sam_sid_to_name(struct winbindd_domain *domain,
 		return NT_STATUS_NO_MEMORY;
 	}
 
+again:
 	status = open_cached_internal_pipe_conn(domain,
 						NULL,
 						NULL,
@@ -622,6 +697,11 @@ static NTSTATUS sam_sid_to_name(struct winbindd_domain *domain,
 				 &name,
 				 &type);
 
+	if (!retry && reset_connection_on_error(domain, lsa_pipe, status)) {
+		retry = true;
+		goto again;
+	}
+
 	if (ptype) {
 		*ptype = type;
 	}
@@ -656,6 +736,7 @@ static NTSTATUS sam_rids_to_names(struct winbindd_domain *domain,
 	char **names = NULL;
 	TALLOC_CTX *tmp_ctx;
 	NTSTATUS status;
+	bool retry = false;
 
 	DEBUG(3,("sam_rids_to_names for %s\n", domain->name));
 
@@ -675,6 +756,7 @@ static NTSTATUS sam_rids_to_names(struct winbindd_domain *domain,
 		return NT_STATUS_NO_MEMORY;
 	}
 
+again:
 	status = open_cached_internal_pipe_conn(domain,
 						NULL,
 						NULL,
@@ -694,6 +776,12 @@ static NTSTATUS sam_rids_to_names(struct winbindd_domain *domain,
 				   &domain_name,
 				   &names,
 				   &types);
+
+	if (!retry && reset_connection_on_error(domain, lsa_pipe, status)) {
+		retry = true;
+		goto again;
+	}
+
 	if (!NT_STATUS_IS_OK(status)) {
 		goto done;
 	}
@@ -725,6 +813,7 @@ static NTSTATUS sam_lockout_policy(struct winbindd_domain *domain,
 	TALLOC_CTX *tmp_ctx;
 	NTSTATUS status, result;
 	struct dcerpc_binding_handle *b = NULL;
+	bool retry = false;
 
 	DEBUG(3,("sam_lockout_policy\n"));
 
@@ -733,6 +822,7 @@ static NTSTATUS sam_lockout_policy(struct winbindd_domain *domain,
 		return NT_STATUS_NO_MEMORY;
 	}
 
+again:
 	status = open_cached_internal_pipe_conn(domain,
 						&samr_pipe,
 						&dom_pol,
@@ -750,6 +840,12 @@ static NTSTATUS sam_lockout_policy(struct winbindd_domain *domain,
 					     DomainLockoutInformation,
 					     &info,
 					     &result);
+
+	if (!retry && reset_connection_on_error(domain, samr_pipe, status)) {
+		retry = true;
+		goto again;
+	}
+
 	if (!NT_STATUS_IS_OK(status)) {
 		goto error;
 	}
@@ -775,6 +871,7 @@ static NTSTATUS sam_password_policy(struct winbindd_domain *domain,
 	TALLOC_CTX *tmp_ctx;
 	NTSTATUS status, result;
 	struct dcerpc_binding_handle *b = NULL;
+	bool retry = false;
 
 	DEBUG(3,("sam_password_policy\n"));
 
@@ -783,6 +880,7 @@ static NTSTATUS sam_password_policy(struct winbindd_domain *domain,
 		return NT_STATUS_NO_MEMORY;
 	}
 
+again:
 	status = open_cached_internal_pipe_conn(domain,
 						&samr_pipe,
 						&dom_pol,
@@ -800,6 +898,12 @@ static NTSTATUS sam_password_policy(struct winbindd_domain *domain,
 					     DomainPasswordInformation,
 					     &info,
 					     &result);
+
+	if (!retry && reset_connection_on_error(domain, samr_pipe, status)) {
+		retry = true;
+		goto again;
+	}
+
 	if (!NT_STATUS_IS_OK(status)) {
 		goto error;
 	}
@@ -828,6 +932,7 @@ static NTSTATUS sam_lookup_usergroups(struct winbindd_domain *domain,
 	uint32_t num_groups = 0;
 	TALLOC_CTX *tmp_ctx;
 	NTSTATUS status;
+	bool retry = false;
 
 	DEBUG(3,("sam_lookup_usergroups\n"));
 
@@ -842,6 +947,7 @@ static NTSTATUS sam_lookup_usergroups(struct winbindd_domain *domain,
 		return NT_STATUS_NO_MEMORY;
 	}
 
+again:
 	status = open_cached_internal_pipe_conn(domain,
 						&samr_pipe,
 						&dom_pol,
@@ -858,6 +964,12 @@ static NTSTATUS sam_lookup_usergroups(struct winbindd_domain *domain,
 				       user_sid,
 				       &num_groups,
 				       &user_grpsids);
+
+	if (!retry && reset_connection_on_error(domain, samr_pipe, status)) {
+		retry = true;
+		goto again;
+	}
+
 	if (!NT_STATUS_IS_OK(status)) {
 		goto done;
 	}
@@ -889,6 +1001,7 @@ static NTSTATUS sam_lookup_useraliases(struct winbindd_domain *domain,
 	uint32_t *alias_rids = NULL;
 	TALLOC_CTX *tmp_ctx;
 	NTSTATUS status;
+	bool retry = false;
 
 	DEBUG(3,("sam_lookup_useraliases\n"));
 
@@ -901,6 +1014,7 @@ static NTSTATUS sam_lookup_useraliases(struct winbindd_domain *domain,
 		return NT_STATUS_NO_MEMORY;
 	}
 
+again:
 	status = open_cached_internal_pipe_conn(domain,
 						&samr_pipe,
 						&dom_pol,
@@ -917,6 +1031,12 @@ static NTSTATUS sam_lookup_useraliases(struct winbindd_domain *domain,
 					sids,
 					&num_aliases,
 					&alias_rids);
+
+	if (!retry && reset_connection_on_error(domain, samr_pipe, status)) {
+		retry = true;
+		goto again;
+	}
+
 	if (!NT_STATUS_IS_OK(status)) {
 		goto done;
 	}
@@ -944,6 +1064,7 @@ static NTSTATUS sam_sequence_number(struct winbindd_domain *domain,
 	uint32_t seq = DOM_SEQUENCE_NONE;
 	TALLOC_CTX *tmp_ctx;
 	NTSTATUS status;
+	bool retry = false;
 
 	DEBUG(3,("samr: sequence number\n"));
 
@@ -956,6 +1077,7 @@ static NTSTATUS sam_sequence_number(struct winbindd_domain *domain,
 		return NT_STATUS_NO_MEMORY;
 	}
 
+again:
 	status = open_cached_internal_pipe_conn(domain,
 						&samr_pipe,
 						&dom_pol,
@@ -970,6 +1092,12 @@ static NTSTATUS sam_sequence_number(struct winbindd_domain *domain,
 				     &dom_pol,
 				     domain->name,
 				     &seq);
+
+	if (!retry && reset_connection_on_error(domain, samr_pipe, status)) {
+		retry = true;
+		goto again;
+	}
+
 	if (!NT_STATUS_IS_OK(status)) {
 		goto done;
 	}

From 414d920eb07d6d1cd727f94eeb24d07d173020b5 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Wed, 21 Mar 2018 21:23:13 +1300
Subject: [PATCH 03/27] winbindd: Use talloc_zero_array for consistency with
 other winbindd_domain allocators

The other allocator for this structure uses talloc_zero()

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
---
 source3/winbindd/wb_seqnums.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/source3/winbindd/wb_seqnums.c b/source3/winbindd/wb_seqnums.c
index 2a4cdc930e8..3c9af01e40f 100644
--- a/source3/winbindd/wb_seqnums.c
+++ b/source3/winbindd/wb_seqnums.c
@@ -56,8 +56,8 @@ struct tevent_req *wb_seqnums_send(TALLOC_CTX *mem_ctx,
 
 	state->subreqs = talloc_array(state, struct tevent_req *,
 				      state->num_domains);
-	state->domains = talloc_array(state, struct winbindd_domain *,
-				      state->num_domains);
+	state->domains = talloc_zero_array(state, struct winbindd_domain *,
+					   state->num_domains);
 	state->stati = talloc_array(state, NTSTATUS, state->num_domains);
 	state->seqnums = talloc_array(state, uint32_t, state->num_domains);
 

From 66634513b96ded69553030b3c3cdde14498f02b2 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Tue, 20 Mar 2018 14:15:47 +1300
Subject: [PATCH 04/27] gitlab-ci: Create swap space to work around the 2G
 image

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
---
 .gitlab-ci.yml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 60accd463a7..287011cd568 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -1,7 +1,12 @@
 # see https://docs.gitlab.com/ce/ci/yaml/README.html for all available options
 
 before_script:
-  - echo "Build starting ..."
+  - echo "Build starting (preparing swap)..."
+  - if [ $(df -m / --output=avail | tail -n1) -gt 10240 ]; then
+      sudo dd if=/dev/zero of=/samba-swap bs=1M count=6144;
+      sudo mkswap /samba-swap;
+      sudo swapon /samba-swap;
+    fi
 
 build_samba:
   stage: build

From d397e2aaa7f620184522ee863f3180f1f081aa36 Mon Sep 17 00:00:00 2001
From: Joe Guo <joeg@catalyst.net.nz>
Date: Tue, 28 Nov 2017 10:20:54 +1300
Subject: [PATCH 05/27] gitlab-ci: set docker image and change tag

1. Specify docker image to use in gitlab-ci.yml
2. Change tag autobuild to docker

So we can use gitlab.com shared runners.

Signed-off-by: Joe Guo <joeg@catalyst.net.nz>
---
 .gitlab-ci.yml | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 287011cd568..77c28af0c81 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -1,5 +1,7 @@
 # see https://docs.gitlab.com/ce/ci/yaml/README.html for all available options
 
+image: registry.gitlab.com/catalyst-samba/samba:latest
+
 before_script:
   - echo "Build starting (preparing swap)..."
   - if [ $(df -m / --output=avail | tail -n1) -gt 10240 ]; then
@@ -11,7 +13,7 @@ before_script:
 build_samba:
   stage: build
   tags:
-    - autobuild
+    - docker
   script:
     # this one takes about 4 hours to finish
     - python script/autobuild.py samba            --verbose --tail --testbase /tmp/samba-testbase
@@ -27,7 +29,7 @@ build_samba_none_env:
 build_samba_others:
   stage: build
   tags:
-    - autobuild
+    - docker
   script:
     - python script/autobuild.py samba-nopython   --verbose --tail --testbase /tmp/samba-testbase
     - python script/autobuild.py samba-systemkrb5 --verbose --tail --testbase /tmp/samba-testbase
@@ -39,7 +41,7 @@ build_samba_others:
 build_ctdb:
   stage: build
   tags:
-    - autobuild
+    - docker
   script:
     - python script/autobuild.py samba-ctdb       --verbose --tail --testbase /tmp/samba-testbase
     - python script/autobuild.py ctdb             --verbose --tail --testbase /tmp/samba-testbase
@@ -47,7 +49,7 @@ build_ctdb:
 build_others:
   stage: build
   tags:
-    - autobuild
+    - docker
   script:
     - python script/autobuild.py ldb              --verbose --tail --testbase /tmp/samba-testbase
     - python script/autobuild.py pidl             --verbose --tail --testbase /tmp/samba-testbase

From d11bdf084a4145f5476c00fdb176f86eee3eff00 Mon Sep 17 00:00:00 2001
From: Joe Guo <joeg@catalyst.net.nz>
Date: Tue, 12 Dec 2017 14:26:07 +1300
Subject: [PATCH 06/27] gitlab-ci: add git variable to speed up clone

Set GIT_STATEGY to fetch, and GIT_DEPTH to 3.
This will speed up cloning for repos.

Signed-off-by: Joe Guo <joeg@catalyst.net.nz>
---
 .gitlab-ci.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 77c28af0c81..7d0c22803c4 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -2,6 +2,10 @@
 
 image: registry.gitlab.com/catalyst-samba/samba:latest
 
+variables:
+  GIT_STRATEGY: fetch
+  GIT_DEPTH: "3"
+
 before_script:
   - echo "Build starting (preparing swap)..."
   - if [ $(df -m / --output=avail | tail -n1) -gt 10240 ]; then

From 2308586ac1fc6861b0246a6c73a4b7f93eea8764 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Fri, 30 Jun 2017 11:15:40 +1200
Subject: [PATCH 07/27] autobuild: Run nt4_dc and nt4_member tests in parallel

These do not interact with the main AD DC environments, so can run in parallel

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
---
 script/autobuild.py | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/script/autobuild.py b/script/autobuild.py
index 699fb41df1f..a385739f507 100755
--- a/script/autobuild.py
+++ b/script/autobuild.py
@@ -26,6 +26,7 @@
 builddirs = {
     "ctdb"    : "ctdb",
     "samba"  : ".",
+    "samba-nt4"  : ".",
     "samba-xc" : ".",
     "samba-o3" : ".",
     "samba-ctdb" : ".",
@@ -48,6 +49,7 @@
 
 defaulttasks = [ "ctdb",
                  "samba",
+                 "samba-nt4",
                  "samba-xc",
                  "samba-o3",
                  "samba-ctdb",
@@ -90,16 +92,25 @@
                ("check-clean-tree", "../script/clean-source-tree.sh", "text/plain"),
                ("clean", "make clean", "text/plain") ],
 
-    # We have 'test' before 'install' because, 'test' should work without 'install'
+    # We have 'test' before 'install' because, 'test' should work without 'install (runs ad_dc_ntvfs and all the other envs)'
     "samba" : [ ("configure", "./configure.developer --with-selftest-prefix=./bin/ab" + samba_configure_params, "text/plain"),
                 ("make", "make -j", "text/plain"),
                 ("test", "make test FAIL_IMMEDIATELY=1 "
-                 "TESTS='--exclude-env=none'",
-                 "text/plain"),
+                 "TESTS='--exclude-env=none' " 
+                 "--exclude-env=nt4_dc "
+                 "--exclude-env=nt4_member'", "text/plain"),
                 ("install", "make install", "text/plain"),
                 ("check-clean-tree", "script/clean-source-tree.sh", "text/plain"),
                 ("clean", "make clean", "text/plain") ],
 
+    # We split out this so the isolated nt4_dc tests do not wait for ad_dc or ad_dc_ntvfs tests (which are long)
+    "samba-nt4" : [ ("configure", "./configure.developer --with-selftest-prefix=./bin/ab" + samba_configure_params, "text/plain"),
+                       ("make", "make -j", "text/plain"),
+                       ("test", "make test FAIL_IMMEDIATELY=1 TESTS='--include-env=nt4_dc --include-env=nt4_member'", "text/plain"),
+                       ("install", "make install", "text/plain"),
+                       ("check-clean-tree", "script/clean-source-tree.sh", "text/plain"),
+                       ("clean", "make clean", "text/plain") ],
+
     "samba-test-only" : [ ("configure", "./configure.developer --with-selftest-prefix=./bin/ab  --abi-check-disable" + samba_configure_params, "text/plain"),
                           ("make", "make -j", "text/plain"),
                           ("test", 'make test FAIL_IMMEDIATELY=1 TESTS="${TESTS}"',"text/plain") ],

From 3c7ccdc73893a8a719f54cd477988d4ad6cc0e9f Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Fri, 30 Jun 2017 11:44:58 +1200
Subject: [PATCH 08/27] travis-ci: Run new samba-nt4 environment

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
---
 .travis.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.travis.yml b/.travis.yml
index 19d5b4ce0f8..7c092660707 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -15,6 +15,7 @@ env:
   - TASK=samba-none-env
   - TASK=samba-nopython
   - TASK=samba-systemkrb5
+  - TASK=samba-nt4
   - TASK=ldb
   - TASK=tdb
   - TASK=talloc

From 54ee3918345f5b13334b6639cfe49d2f33de89c2 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Tue, 5 Dec 2017 11:34:08 +1300
Subject: [PATCH 09/27] gitlab-ci: Add samba-nt4 environment to the CI

This parallel build is de-coupled from the main samba build

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
---
 .gitlab-ci.yml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 7d0c22803c4..8b824c5660c 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -22,6 +22,14 @@ build_samba:
     # this one takes about 4 hours to finish
     - python script/autobuild.py samba            --verbose --tail --testbase /tmp/samba-testbase
 
+build_samba_nt4:
+  stage: build
+  tags:
+    - autobuild
+  script:
+    # this one takes about 1 hours to finish
+    - python script/autobuild.py samba-nt4        --verbose --tail --testbase /tmp/samba-testbase
+
 build_samba_none_env:
   stage: build
   tags:

From 47ad6f1169e0aee93b130025b2cf76409961596d Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Sat, 3 Mar 2018 21:03:11 +1300
Subject: [PATCH 10/27] selftest: Do not run smb2.notify against nt4_dc and
 ad_dc

This is a slow test and we need to keep the time on ad_dc down to below 50mins total
for travis-ci.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
---
 source3/selftest/tests.py | 1 -
 1 file changed, 1 deletion(-)

diff --git a/source3/selftest/tests.py b/source3/selftest/tests.py
index c93abf5e632..a65edcea713 100755
--- a/source3/selftest/tests.py
+++ b/source3/selftest/tests.py
@@ -519,7 +519,6 @@ def plansmbtorture4testsuite(name, env, options, description=''):
         plansmbtorture4testsuite(t, "simpleserver", '//$SERVER/tmp -U$USERNAME%$PASSWORD')
     elif t == "smb2.notify":
         plansmbtorture4testsuite(t, "nt4_dc", '//$SERVER_IP/tmp -U$USERNAME%$PASSWORD --signing=required')
-        plansmbtorture4testsuite(t, "ad_dc", '//$SERVER/tmp -U$USERNAME%$PASSWORD --signing=required')
     elif t == "smb2.dosmode":
         plansmbtorture4testsuite(t, "simpleserver", '//$SERVER/dosmode -U$USERNAME%$PASSWORD')
     elif t == "smb2.kernel-oplocks":

From 347085f0795e1e74832e6f820f4901d00d5e1cd3 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Fri, 30 Jun 2017 11:13:55 +1200
Subject: [PATCH 11/27] autobuild: Run all "ad_dc" environment tests in
 samba-ad-dc

This allows us not to run ad_dc tests in the main build, making the
autobuild process faster.  The ad_dc tests run in less than 50mins
on travis-ci, which allows this part of the tests to be run.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
---
 .gitlab-ci.yml      |  8 ++++++++
 .travis.yml         |  1 +
 script/autobuild.py | 12 +++++++++++-
 3 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 8b824c5660c..aff970c7ba5 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -30,6 +30,14 @@ build_samba_nt4:
     # this one takes about 1 hours to finish
     - python script/autobuild.py samba-nt4        --verbose --tail --testbase /tmp/samba-testbase
 
+build_samba_ad_dc:
+  stage: build
+  tags:
+    - autobuild
+  script:
+    # this one takes about 1 hours to finish
+    - python script/autobuild.py samba-ad-dc     --verbose --tail --testbase /tmp/samba-testbase
+
 build_samba_none_env:
   stage: build
   tags:
diff --git a/.travis.yml b/.travis.yml
index 7c092660707..acd6f484100 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -16,6 +16,7 @@ env:
   - TASK=samba-nopython
   - TASK=samba-systemkrb5
   - TASK=samba-nt4
+  - TASK=samba-ad-dc
   - TASK=ldb
   - TASK=tdb
   - TASK=talloc
diff --git a/script/autobuild.py b/script/autobuild.py
index a385739f507..90317079abf 100755
--- a/script/autobuild.py
+++ b/script/autobuild.py
@@ -34,6 +34,7 @@
     "samba-static"  : ".",
     "samba-test-only"  : ".",
     "samba-none-env"  : ".",
+    "samba-ad-dc"  : ".",
     "samba-systemkrb5"  : ".",
     "samba-nopython"  : ".",
     "ldb"     : "lib/ldb",
@@ -56,6 +57,7 @@
                  "samba-libs",
                  "samba-static",
                  "samba-none-env",
+                 "samba-ad-dc",
                  "samba-systemkrb5",
                  "samba-nopython",
                  "ldb",
@@ -98,7 +100,8 @@
                 ("test", "make test FAIL_IMMEDIATELY=1 "
                  "TESTS='--exclude-env=none' " 
                  "--exclude-env=nt4_dc "
-                 "--exclude-env=nt4_member'", "text/plain"),
+                 "--exclude-env=nt4_member "
+                 "--exclude-env=ad_dc ", "text/plain"),
                 ("install", "make install", "text/plain"),
                 ("check-clean-tree", "script/clean-source-tree.sh", "text/plain"),
                 ("clean", "make clean", "text/plain") ],
@@ -111,6 +114,13 @@
                        ("check-clean-tree", "script/clean-source-tree.sh", "text/plain"),
                        ("clean", "make clean", "text/plain") ],
 
+    # We split out this so the isolated ad_dc tests do not wait for ad_dc_ntvfs tests (which are long)
+    "samba-ad-dc" : [ ("random-sleep", "../script/random-sleep.sh 60 600", "text/plain"),
+                      ("configure", "./configure.developer --with-selftest-prefix=./bin/ab" + samba_configure_params, "text/plain"),
+                      ("make", "make -j", "text/plain"),
+                      ("test", "make test FAIL_IMMEDIATELY=1 TESTS='--include-env=ad_dc'", "text/plain"),
+                      ("check-clean-tree", "script/clean-source-tree.sh", "text/plain")],
+
     "samba-test-only" : [ ("configure", "./configure.developer --with-selftest-prefix=./bin/ab  --abi-check-disable" + samba_configure_params, "text/plain"),
                           ("make", "make -j", "text/plain"),
                           ("test", 'make test FAIL_IMMEDIATELY=1 TESTS="${TESTS}"',"text/plain") ],

From 9dc422720b65020bc4f4d8e9dd5115cb8f8f6a4e Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Sun, 4 Mar 2018 21:32:09 +1300
Subject: [PATCH 12/27] autobuild: Remove fileserver tests from the main build

Again, this is to allow these to run in the 50min timelimit
of travis-ci and so gain test coverage.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
---
 .gitlab-ci.yml      |  8 ++++++++
 .travis.yml         |  1 +
 script/autobuild.py | 13 ++++++++++++-
 3 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index aff970c7ba5..ee62aa10563 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -30,6 +30,14 @@ build_samba_nt4:
     # this one takes about 1 hours to finish
     - python script/autobuild.py samba-nt4        --verbose --tail --testbase /tmp/samba-testbase
 
+build_samba_fileserver:
+  stage: build
+  tags:
+    - autobuild
+  script:
+    # this one takes about 1 hours to finish
+    - python script/autobuild.py samba-fileserver --verbose --tail --testbase /tmp/samba-testbase
+
 build_samba_ad_dc:
   stage: build
   tags:
diff --git a/.travis.yml b/.travis.yml
index acd6f484100..2ef0a0b1653 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -16,6 +16,7 @@ env:
   - TASK=samba-nopython
   - TASK=samba-systemkrb5
   - TASK=samba-nt4
+  - TASK=samba-fileserver
   - TASK=samba-ad-dc
   - TASK=ldb
   - TASK=tdb
diff --git a/script/autobuild.py b/script/autobuild.py
index 90317079abf..c29b3e521c4 100755
--- a/script/autobuild.py
+++ b/script/autobuild.py
@@ -27,6 +27,7 @@
     "ctdb"    : "ctdb",
     "samba"  : ".",
     "samba-nt4"  : ".",
+    "samba-fileserver"  : ".",
     "samba-xc" : ".",
     "samba-o3" : ".",
     "samba-ctdb" : ".",
@@ -51,6 +52,7 @@
 defaulttasks = [ "ctdb",
                  "samba",
                  "samba-nt4",
+                 "samba-fileserver",
                  "samba-xc",
                  "samba-o3",
                  "samba-ctdb",
@@ -101,7 +103,9 @@
                  "TESTS='--exclude-env=none' " 
                  "--exclude-env=nt4_dc "
                  "--exclude-env=nt4_member "
-                 "--exclude-env=ad_dc ", "text/plain"),
+                 "--exclude-env=ad_dc "
+                 "--exclude-env=fileserver'",
+                 "text/plain"),
                 ("install", "make install", "text/plain"),
                 ("check-clean-tree", "script/clean-source-tree.sh", "text/plain"),
                 ("clean", "make clean", "text/plain") ],
@@ -114,6 +118,13 @@
                        ("check-clean-tree", "script/clean-source-tree.sh", "text/plain"),
                        ("clean", "make clean", "text/plain") ],
 
+    # We split out this so the isolated ad_dc tests do not wait for ad_dc_ntvfs tests (which are long)
+    "samba-fileserver" : [ ("random-sleep", "../script/random-sleep.sh 60 600", "text/plain"),
+                      ("configure", "./configure.developer --with-selftest-prefix=./bin/ab" + samba_configure_params, "text/plain"),
+                      ("make", "make -j", "text/plain"),
+                      ("test", "make test FAIL_IMMEDIATELY=1 TESTS='--include-env=fileserver'", "text/plain"),
+                      ("check-clean-tree", "script/clean-source-tree.sh", "text/plain")],
+
     # We split out this so the isolated ad_dc tests do not wait for ad_dc_ntvfs tests (which are long)
     "samba-ad-dc" : [ ("random-sleep", "../script/random-sleep.sh 60 600", "text/plain"),
                       ("configure", "./configure.developer --with-selftest-prefix=./bin/ab" + samba_configure_params, "text/plain"),

From 30fbc7846824e719c221ce45ecf07d693dc12f56 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Sun, 4 Mar 2018 21:20:31 +1300
Subject: [PATCH 13/27] selftest: Move base.delaywrite tests to fileserver
 environment

This aims to keep the ad_dc tests well below 50mins for travis CI and
base.delaywrite is very slow.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
---
 source3/selftest/tests.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/source3/selftest/tests.py b/source3/selftest/tests.py
index a65edcea713..9ac8233aa6c 100755
--- a/source3/selftest/tests.py
+++ b/source3/selftest/tests.py
@@ -405,7 +405,7 @@ def plansmbtorture4testsuite(name, env, options, description=''):
 
 for t in tests:
     if t == "base.delaywrite":
-        plansmbtorture4testsuite(t, "ad_dc", '//$SERVER/tmp -U$USERNAME%$PASSWORD -k yes --maximum-runtime=900')
+        plansmbtorture4testsuite(t, "fileserver", '//$SERVER/tmp -U$USERNAME%$PASSWORD --maximum-runtime=900')
     elif t == "base.createx_access":
         plansmbtorture4testsuite(t, "ad_dc", '//$SERVER/tmp -U$USERNAME%$PASSWORD -k yes --maximum-runtime=900')
     elif t == "rap.sam":

From a16d3df71b33ce1244750cd2d5bf87570503c213 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Sun, 4 Mar 2018 21:33:50 +1300
Subject: [PATCH 14/27] Move smbtorture3 tests to fileserver environment

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
---
 source3/selftest/tests.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/source3/selftest/tests.py b/source3/selftest/tests.py
index 9ac8233aa6c..393615cb77c 100755
--- a/source3/selftest/tests.py
+++ b/source3/selftest/tests.py
@@ -85,7 +85,7 @@ def plansmbtorture4testsuite(name, env, options, description=''):
         "BAD-NBT-SESSION"]
 
 for t in tests:
-    plantestsuite("samba3.smbtorture_s3.plain(nt4_dc).%s" % t, "nt4_dc", [os.path.join(samba3srcdir, "script/tests/test_smbtorture_s3.sh"), t, '//$SERVER_IP/tmp', '$USERNAME', '$PASSWORD', smbtorture3, "", "-l $LOCAL_PATH"])
+    plantestsuite("samba3.smbtorture_s3.plain(fileserver).%s" % t, "fileserver", [os.path.join(samba3srcdir, "script/tests/test_smbtorture_s3.sh"), t, '//$SERVER_IP/tmp', '$USERNAME', '$PASSWORD', smbtorture3, "", "-l $LOCAL_PATH"])
     plantestsuite("samba3.smbtorture_s3.crypt_client(nt4_dc).%s" % t, "nt4_dc", [os.path.join(samba3srcdir, "script/tests/test_smbtorture_s3.sh"), t, '//$SERVER_IP/tmp', '$USERNAME', '$PASSWORD', smbtorture3, "-e", "-l $LOCAL_PATH"])
     if t == "TORTURE":
         # this is a negative test to verify that the server rejects

From ad4d738e77b2b58c9489a0a088e321d5ba06d9cc Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Sun, 4 Mar 2018 21:36:22 +1300
Subject: [PATCH 15/27] autobuild: Try and test different configure options for
 new environments

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
---
 script/autobuild.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/script/autobuild.py b/script/autobuild.py
index c29b3e521c4..4e32fc8b4e3 100755
--- a/script/autobuild.py
+++ b/script/autobuild.py
@@ -120,7 +120,7 @@
 
     # We split out this so the isolated ad_dc tests do not wait for ad_dc_ntvfs tests (which are long)
     "samba-fileserver" : [ ("random-sleep", "../script/random-sleep.sh 60 600", "text/plain"),
-                      ("configure", "./configure.developer --with-selftest-prefix=./bin/ab" + samba_configure_params, "text/plain"),
+                      ("configure", "./configure.developer --without-ad-dc --without-ads --with-selftest-prefix=./bin/ab" + samba_configure_params, "text/plain"),
                       ("make", "make -j", "text/plain"),
                       ("test", "make test FAIL_IMMEDIATELY=1 TESTS='--include-env=fileserver'", "text/plain"),
                       ("check-clean-tree", "script/clean-source-tree.sh", "text/plain")],

From 8a60e9223ff03e91993f8477b1e7a7e216c4d1c3 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Mon, 5 Mar 2018 08:04:22 +1300
Subject: [PATCH 16/27] selftest: Move slower base.deny1 and base.deny2 to
 fileserver environment

This avoids these running in the ad_dc environment which we need to get under 50mins for
travis-ci.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
---
 source3/selftest/tests.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/source3/selftest/tests.py b/source3/selftest/tests.py
index 393615cb77c..00e04318c7c 100755
--- a/source3/selftest/tests.py
+++ b/source3/selftest/tests.py
@@ -404,7 +404,7 @@ def plansmbtorture4testsuite(name, env, options, description=''):
 tests= base + raw + smb2 + rpc + unix + local + rap + nbt + libsmbclient + idmap + vfs
 
 for t in tests:
-    if t == "base.delaywrite":
+    if t == "base.delaywrite" or t == "base.deny1" or t == "base.deny2":
         plansmbtorture4testsuite(t, "fileserver", '//$SERVER/tmp -U$USERNAME%$PASSWORD --maximum-runtime=900')
     elif t == "base.createx_access":
         plansmbtorture4testsuite(t, "ad_dc", '//$SERVER/tmp -U$USERNAME%$PASSWORD -k yes --maximum-runtime=900')

From 788b5d72a113b33dd36247d3e83313506dddaa54 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Mon, 5 Mar 2018 17:08:51 +1300
Subject: [PATCH 17/27] selftest: Move samba.tests.samba_tool{.dnscmd,.sites}
 to chgdcpass

This helps reduce the runtime of ad_dc which needs to be under 50mins
including build time to run on travis-ci.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
---
 source4/selftest/tests.py | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py
index 700decd8b9d..adbca195c2a 100755
--- a/source4/selftest/tests.py
+++ b/source4/selftest/tests.py
@@ -612,8 +612,9 @@ def planoldpythontestsuite(env, module, name=None, extra_path=[], environ={}, ex
 planpythontestsuite("none", "samba.tests.samba_tool.provision_password_check")
 planpythontestsuite("none", "samba.tests.samba_tool.help")
 
-planpythontestsuite("ad_dc:local", "samba.tests.samba_tool.sites")
-planpythontestsuite("ad_dc:local", "samba.tests.samba_tool.dnscmd")
+# Run these against chgdcpass to share the runtime load
+planpythontestsuite("chgdcpass:local", "samba.tests.samba_tool.sites")
+planpythontestsuite("chgdcpass:local", "samba.tests.samba_tool.dnscmd")
 
 planpythontestsuite("ad_dc_ntvfs:local", "samba.tests.dcerpc.rpcecho")
 

From cf662ea62db85ae1e7440f623063cc35c989d37f Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Tue, 20 Mar 2018 15:07:03 +1300
Subject: [PATCH 18/27] gitlab-ci: Set shared and private tags to allow builds
 that need ext4 to pass

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
---
 .gitlab-ci.yml | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index ee62aa10563..a4354dad63c 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -18,6 +18,7 @@ build_samba:
   stage: build
   tags:
     - docker
+    - private
   script:
     # this one takes about 4 hours to finish
     - python script/autobuild.py samba            --verbose --tail --testbase /tmp/samba-testbase
@@ -25,7 +26,8 @@ build_samba:
 build_samba_nt4:
   stage: build
   tags:
-    - autobuild
+    - docker
+    - private
   script:
     # this one takes about 1 hours to finish
     - python script/autobuild.py samba-nt4        --verbose --tail --testbase /tmp/samba-testbase
@@ -33,7 +35,8 @@ build_samba_nt4:
 build_samba_fileserver:
   stage: build
   tags:
-    - autobuild
+    - docker
+    - shared
   script:
     # this one takes about 1 hours to finish
     - python script/autobuild.py samba-fileserver --verbose --tail --testbase /tmp/samba-testbase
@@ -41,7 +44,8 @@ build_samba_fileserver:
 build_samba_ad_dc:
   stage: build
   tags:
-    - autobuild
+    - docker
+    - private
   script:
     # this one takes about 1 hours to finish
     - python script/autobuild.py samba-ad-dc     --verbose --tail --testbase /tmp/samba-testbase
@@ -49,7 +53,8 @@ build_samba_ad_dc:
 build_samba_none_env:
   stage: build
   tags:
-    - autobuild
+    - docker
+    - shared
   script:
     # this one takes about 1 hours to finish
     - python script/autobuild.py samba-none-env    --verbose --tail --testbase /tmp/samba-testbase
@@ -58,6 +63,7 @@ build_samba_others:
   stage: build
   tags:
     - docker
+    - shared
   script:
     - python script/autobuild.py samba-nopython   --verbose --tail --testbase /tmp/samba-testbase
     - python script/autobuild.py samba-systemkrb5 --verbose --tail --testbase /tmp/samba-testbase
@@ -70,6 +76,7 @@ build_ctdb:
   stage: build
   tags:
     - docker
+    - shared
   script:
     - python script/autobuild.py samba-ctdb       --verbose --tail --testbase /tmp/samba-testbase
     - python script/autobuild.py ctdb             --verbose --tail --testbase /tmp/samba-testbase
@@ -78,6 +85,7 @@ build_others:
   stage: build
   tags:
     - docker
+    - shared
   script:
     - python script/autobuild.py ldb              --verbose --tail --testbase /tmp/samba-testbase
     - python script/autobuild.py pidl             --verbose --tail --testbase /tmp/samba-testbase

From bccaa6b39443096ed56396c348a4fcfb53b93ddc Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Wed, 21 Mar 2018 07:02:42 +1300
Subject: [PATCH 19/27] autobuild: Split up the build further with
 samba-ad-dc-2

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
---
 .gitlab-ci.yml      |  9 +++++++++
 .travis.yml         |  1 +
 script/autobuild.py | 19 +++++++++++++++++++
 3 files changed, 29 insertions(+)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index a4354dad63c..653ebbd8d6b 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -50,6 +50,15 @@ build_samba_ad_dc:
     # this one takes about 1 hours to finish
     - python script/autobuild.py samba-ad-dc     --verbose --tail --testbase /tmp/samba-testbase
 
+build_samba_ad_dc_2:
+  stage: build
+  tags:
+    - docker
+    - private
+  script:
+    # this one takes about 1 hours to finish
+    - python script/autobuild.py samba-ad-dc-2     --verbose --tail --testbase /tmp/samba-testbase
+
 build_samba_none_env:
   stage: build
   tags:
diff --git a/.travis.yml b/.travis.yml
index 2ef0a0b1653..e9b6a6b2938 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -18,6 +18,7 @@ env:
   - TASK=samba-nt4
   - TASK=samba-fileserver
   - TASK=samba-ad-dc
+  - TASK=samba-ad-dc-2
   - TASK=ldb
   - TASK=tdb
   - TASK=talloc
diff --git a/script/autobuild.py b/script/autobuild.py
index 4e32fc8b4e3..9ae0f529cc7 100755
--- a/script/autobuild.py
+++ b/script/autobuild.py
@@ -36,6 +36,7 @@
     "samba-test-only"  : ".",
     "samba-none-env"  : ".",
     "samba-ad-dc"  : ".",
+    "samba-ad-dc-2"  : ".",
     "samba-systemkrb5"  : ".",
     "samba-nopython"  : ".",
     "ldb"     : "lib/ldb",
@@ -60,6 +61,7 @@
                  "samba-static",
                  "samba-none-env",
                  "samba-ad-dc",
+                 "samba-ad-dc-2",
                  "samba-systemkrb5",
                  "samba-nopython",
                  "ldb",
@@ -104,6 +106,9 @@
                  "--exclude-env=nt4_dc "
                  "--exclude-env=nt4_member "
                  "--exclude-env=ad_dc "
+                 "--exclude-env=chgdcpass "
+                 "--exclude-env=vampire_2000_dc "
+                 "--exclude-env=fl2000dc "
                  "--exclude-env=fileserver'",
                  "text/plain"),
                 ("install", "make install", "text/plain"),
@@ -132,6 +137,20 @@
                       ("test", "make test FAIL_IMMEDIATELY=1 TESTS='--include-env=ad_dc'", "text/plain"),
                       ("check-clean-tree", "script/clean-source-tree.sh", "text/plain")],
 
+    # We split out this so the isolated ad_dc tests do not wait for ad_dc_ntvfs tests (which are long)
+    "samba-ad-dc-2" : [ ("random-sleep", "../script/random-sleep.sh 60 600", "text/plain"),
+                      ("configure", "./configure.developer --with-selftest-prefix=./bin/ab" + samba_configure_params, "text/plain"),
+                      ("make", "make -j", "text/plain"),
+                      ("test", "make test FAIL_IMMEDIATELY=1 TESTS='--include-env=chgdcpass --include-env=vampire_2000_dc --include-env=fl2000dc'", "text/plain"),
+                      ("check-clean-tree", "script/clean-source-tree.sh", "text/plain")],
+
+    # We split out this so the isolated ad_dc tests do not wait for ad_dc_ntvfs tests (which are long)
+    "samba-ad-dc-2" : [ ("random-sleep", "../script/random-sleep.sh 60 600", "text/plain"),
+                      ("configure", "./configure.developer --with-selftest-prefix=./bin/ab" + samba_configure_params, "text/plain"),
+                      ("make", "make -j", "text/plain"),
+                      ("test", "make test FAIL_IMMEDIATELY=1 TESTS='--include-env=chgdcpass --include-env=vampire_2000_dc --include-env=fl2000dc'", "text/plain"),
+                      ("check-clean-tree", "script/clean-source-tree.sh", "text/plain")],
+
     "samba-test-only" : [ ("configure", "./configure.developer --with-selftest-prefix=./bin/ab  --abi-check-disable" + samba_configure_params, "text/plain"),
                           ("make", "make -j", "text/plain"),
                           ("test", 'make test FAIL_IMMEDIATELY=1 TESTS="${TESTS}"',"text/plain") ],

From b7327a12a6faada1313c1483aeabb46a370aa419 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Wed, 21 Mar 2018 07:24:23 +1300
Subject: [PATCH 20/27] gitlab: Run fileserver tests on "private" not "shared"

This might make the delaywrite tests pass

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
---
 .gitlab-ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 653ebbd8d6b..faf04e3e2f7 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -36,7 +36,7 @@ build_samba_fileserver:
   stage: build
   tags:
     - docker
-    - shared
+    - private
   script:
     # this one takes about 1 hours to finish
     - python script/autobuild.py samba-fileserver --verbose --tail --testbase /tmp/samba-testbase

From b1540d2f2f83fee0cd9277a9e67458d0cd49d872 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Thu, 22 Mar 2018 08:25:41 +1300
Subject: [PATCH 21/27] autobuild: Run all envs that depend on ad_dc in the
 ad_dc job

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
---
 script/autobuild.py | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/script/autobuild.py b/script/autobuild.py
index 9ae0f529cc7..95e152914fc 100755
--- a/script/autobuild.py
+++ b/script/autobuild.py
@@ -106,6 +106,11 @@
                  "--exclude-env=nt4_dc "
                  "--exclude-env=nt4_member "
                  "--exclude-env=ad_dc "
+                 "--exclude-env=fl2003dc "
+                 "--exclude-env=fl2008r2dc "
+                 "--exclude-env=ad_member "
+                 "--exclude-env=ad_member_idmap_rid "
+                 "--exclude-env=ad_member_idmap_ad "
                  "--exclude-env=chgdcpass "
                  "--exclude-env=vampire_2000_dc "
                  "--exclude-env=fl2000dc "
@@ -134,7 +139,13 @@
     "samba-ad-dc" : [ ("random-sleep", "../script/random-sleep.sh 60 600", "text/plain"),
                       ("configure", "./configure.developer --with-selftest-prefix=./bin/ab" + samba_configure_params, "text/plain"),
                       ("make", "make -j", "text/plain"),
-                      ("test", "make test FAIL_IMMEDIATELY=1 TESTS='--include-env=ad_dc'", "text/plain"),
+                      ("test", "make test FAIL_IMMEDIATELY=1 TESTS='"
+                       "--include-env=ad_dc "
+                       "--include-env=fl2003dc "
+                       "--include-env=fl2008r2dc "
+                       "--include-env=ad_member "
+                       "--include-env=ad_member_idmap_rid "
+                       "--include-env=ad_member_idmap_ad'", "text/plain"),
                       ("check-clean-tree", "script/clean-source-tree.sh", "text/plain")],
 
     # We split out this so the isolated ad_dc tests do not wait for ad_dc_ntvfs tests (which are long)

From a0c1bdc060a991bb47dfb8db918c213e08f87b62 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Thu, 22 Mar 2018 12:02:16 +1300
Subject: [PATCH 22/27] selftest: Do not run raw.notify, smb2.oplock and
 raw.oplock twice

These are slower tests that do not need to be run against the ad_dc configuration
in particular.

This saves time in the ad_dc job which needs to stay under 50mins to
pass on travis-ci (and faster tests are better for everyone anyway).

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
---
 source3/selftest/tests.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/source3/selftest/tests.py b/source3/selftest/tests.py
index 00e04318c7c..a4ded32195b 100755
--- a/source3/selftest/tests.py
+++ b/source3/selftest/tests.py
@@ -517,7 +517,8 @@ def plansmbtorture4testsuite(name, env, options, description=''):
             plansmbtorture4testsuite(t, env, '//$SERVER/tmp -U$USERNAME%$PASSWORD')
     elif t == "smb2.change_notify_disabled":
         plansmbtorture4testsuite(t, "simpleserver", '//$SERVER/tmp -U$USERNAME%$PASSWORD')
-    elif t == "smb2.notify":
+    elif t == "smb2.notify" or t == "raw.notify" or t == "smb2.oplock" or t == "raw.oplock":
+        # These tests are a little slower so don't duplicate them with ad_dc
         plansmbtorture4testsuite(t, "nt4_dc", '//$SERVER_IP/tmp -U$USERNAME%$PASSWORD --signing=required')
     elif t == "smb2.dosmode":
         plansmbtorture4testsuite(t, "simpleserver", '//$SERVER/dosmode -U$USERNAME%$PASSWORD')

From 66f53e6d8c6e1ecdfca4c00b611362e3bdb03cda Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Thu, 22 Mar 2018 12:21:52 +1300
Subject: [PATCH 23/27] selftest: Do not run krb5.kdc machine account test
 against ad_dc

This code is already well tested against fl2008r2dc and just as per
8f1557a2c43e287c07723c16be78e1d858f4111d this test is slow and we can afford to be
more selective here.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
---
 source4/selftest/tests.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py
index adbca195c2a..e3c74900842 100755
--- a/source4/selftest/tests.py
+++ b/source4/selftest/tests.py
@@ -978,7 +978,7 @@ def planoldpythontestsuite(env, module, name=None, extra_path=[], environ={}, ex
                          "samba4.krb5.kdc with specified account")
 
 
-for env in ["rodc", "promoted_dc", "ad_dc", "fl2000dc", "fl2008r2dc"]:
+for env in ["rodc", "promoted_dc", "fl2000dc", "fl2008r2dc"]:
     if env == "rodc":
         # The machine account is cached at the RODC, as it is the local account
         extra_options = ['--option=torture:expect_rodc=true', '--option=torture:expect_cached_at_rodc=true']

From 529031f73360c0f389eda7d6b27cbee6da309e1c Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Thu, 22 Mar 2018 15:13:18 +1300
Subject: [PATCH 24/27] gitlab-ci: Split up build_samba_others and build_ctdb
 tasks

These make too much output and the shared runners on GitLab CI object to
sending more than 4MB of output.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
---
 .gitlab-ci.yml | 44 +++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 43 insertions(+), 1 deletion(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index faf04e3e2f7..8220fb236d9 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -68,17 +68,52 @@ build_samba_none_env:
     # this one takes about 1 hours to finish
     - python script/autobuild.py samba-none-env    --verbose --tail --testbase /tmp/samba-testbase
 
-build_samba_others:
+build_samba_nopython:
   stage: build
   tags:
     - docker
     - shared
   script:
     - python script/autobuild.py samba-nopython   --verbose --tail --testbase /tmp/samba-testbase
+
+build_samba_systemkrb5:
+  stage: build
+  tags:
+    - docker
+    - shared
+  script:
     - python script/autobuild.py samba-systemkrb5 --verbose --tail --testbase /tmp/samba-testbase
+
+build_samba_xc:
+  stage: build
+  tags:
+    - docker
+    - shared
+  script:
     - python script/autobuild.py samba-xc         --verbose --tail --testbase /tmp/samba-testbase
+
+build_samba_o3:
+  stage: build
+  tags:
+    - docker
+    - shared
+  script:
     - python script/autobuild.py samba-o3         --verbose --tail --testbase /tmp/samba-testbase
+
+build_samba_libs:
+  stage: build
+  tags:
+    - docker
+    - shared
+  script:
     - python script/autobuild.py samba-libs       --verbose --tail --testbase /tmp/samba-testbase
+
+build_samba_static:
+  stage: build
+  tags:
+    - docker
+    - shared
+  script:
     - python script/autobuild.py samba-static     --verbose --tail --testbase /tmp/samba-testbase
 
 build_ctdb:
@@ -88,6 +123,13 @@ build_ctdb:
     - shared
   script:
     - python script/autobuild.py samba-ctdb       --verbose --tail --testbase /tmp/samba-testbase
+
+build_samba_ctdb:
+  stage: build
+  tags:
+    - docker
+    - shared
+  script:
     - python script/autobuild.py ctdb             --verbose --tail --testbase /tmp/samba-testbase
 
 build_others:

From 266731a36c34b30f667c8a219e62162d51a7a4a6 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Thu, 22 Mar 2018 16:25:59 +1300
Subject: [PATCH 25/27] selftest: Move slow raw_protocol test to chgdcpass
 environment

The ad_dc environment is busy and we need to keep it under 50mins for travis CI, so run
this on a different environment with a shorter runtime.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
---
 source4/selftest/tests.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py
index e3c74900842..a8d18c5ded1 100755
--- a/source4/selftest/tests.py
+++ b/source4/selftest/tests.py
@@ -625,7 +625,7 @@ def planoldpythontestsuite(env, module, name=None, extra_path=[], environ={}, ex
 planoldpythontestsuite("ad_dc_ntvfs:local", "samba.tests.dcerpc.registry", extra_args=['-U"$USERNAME%$PASSWORD"'])
 planoldpythontestsuite("ad_dc_ntvfs", "samba.tests.dcerpc.dnsserver", extra_args=['-U"$USERNAME%$PASSWORD"'])
 planoldpythontestsuite("ad_dc", "samba.tests.dcerpc.dnsserver", extra_args=['-U"$USERNAME%$PASSWORD"'])
-planoldpythontestsuite("ad_dc", "samba.tests.dcerpc.raw_protocol", extra_args=['-U"$USERNAME%$PASSWORD"'])
+planoldpythontestsuite("chgdcpass", "samba.tests.dcerpc.raw_protocol", extra_args=['-U"$USERNAME%$PASSWORD"'])
 if have_heimdal_support:
     planoldpythontestsuite("ad_dc:local", "samba.tests.auth_log", extra_args=['-U"$USERNAME%$PASSWORD"'],
                            environ={'CLIENT_IP': '127.0.0.11',

From 301b153ebc5c29d24db634086b780c7018a444b6 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Thu, 22 Mar 2018 16:45:05 +1300
Subject: [PATCH 26/27] selftest: Do not run *.lock tests against both nt4_dc
 and ad_dc

This part of the protocol is not changed by being an AD DC.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
---
 source3/selftest/tests.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/source3/selftest/tests.py b/source3/selftest/tests.py
index a4ded32195b..a9b7c209393 100755
--- a/source3/selftest/tests.py
+++ b/source3/selftest/tests.py
@@ -488,7 +488,8 @@ def plansmbtorture4testsuite(name, env, options, description=''):
     elif t == "smb2.lock":
         plansmbtorture4testsuite(t, "nt4_dc", '//$SERVER_IP/aio -U$USERNAME%$PASSWORD', 'aio')
         plansmbtorture4testsuite(t, "nt4_dc", '//$SERVER_IP/tmp -U$USERNAME%$PASSWORD')
-        plansmbtorture4testsuite(t, "ad_dc", '//$SERVER/tmp -U$USERNAME%$PASSWORD')
+    elif t == "raw.lock" or t == "base.lock":
+        plansmbtorture4testsuite(t, "nt4_dc", '//$SERVER_IP/tmp -U$USERNAME%$PASSWORD')
     elif t == "raw.read":
         plansmbtorture4testsuite(t, "nt4_dc", '//$SERVER_IP/tmp -U$USERNAME%$PASSWORD')
         plansmbtorture4testsuite(t, "nt4_dc", '//$SERVER_IP/aio -U$USERNAME%$PASSWORD', 'aio')

From d4f0f12da170deb439fd4a5998a9164f903bf28e Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Thu, 22 Mar 2018 16:49:53 +1300
Subject: [PATCH 27/27] selftest: Run net.api.become.dc against less roles

This test is slower than many and need not be run five times.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
---
 source4/selftest/tests.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py
index a8d18c5ded1..660a75fb927 100755
--- a/source4/selftest/tests.py
+++ b/source4/selftest/tests.py
@@ -263,6 +263,8 @@ def plansmbtorture4testsuite(name, env, options, modname=None):
         for bindoptions in ["connect", "krb5", "krb5,sign", "krb5,seal", "spnego", "spnego,sign", "spnego,seal"] + validate_list + ["padcheck", "bigendian", "bigendian,seal"]:
             echooptions = "--option=socket:testnonblock=True --option=torture:quick=yes -k yes"
             plansmbtorture4testsuite('rpc.echo', env, ["%s:$SERVER[%s]" % (transport, bindoptions), echooptions, '-U$USERNAME%$PASSWORD', '--workgroup=$DOMAIN'], "samba4.rpc.echo on %s with %s and %s" % (transport, bindoptions, echooptions))
+
+for env in ["fl2000dc", "fl2008r2dc"]:
     plansmbtorture4testsuite("net.api.become.dc", env, '$SERVER[%s] -U$USERNAME%%$PASSWORD -W$DOMAIN' % validate)
 
 for bindoptions in ["sign", "seal"]: