[SCM] Samba Shared Repository - branch v4-4-stable updated

Karolin Seeger kseeger at samba.org
Wed Mar 1 08:54:58 UTC 2017


The branch, v4-4-stable has been updated
       via  51ad60b VERSION: Disable GIT_SNAPSHOTS for the 4.4.10 release.
       via  e72e619 WHATSNEW: Add release notes for Samba 4.4.10.
       via  7d2d7dc s3:winbindd: allow a fallback to NTLMSSP for LDAP connections
       via  fa1846c s3:libads: add more debugging to ads_sasl_spnego_bind()
       via  ba39080 s3:winbindd: rely on the kerberos_state from pdb_get_trust_credentials()
       via  c07f071 s3:winbindd: add more debugging to cm_prepare_connection()
       via  91e5a7c s3:passdb: use cli_credentials_set_kerberos_state() for trusts in pdb_get_trust_credentials()
       via  ad3da42 s3:winbindd: fix the valid usage anonymous smb authentication
       via  36da5cc auth/credentials: try to use kerberos with the machine account unless we're in an AD domain
       via  7984693 s3:winbindd: try a NETLOGON connection with noauth over NCACN_NP against trusted domains.
       via  a605f6c s3:winbindd: make sure cm_prepare_connection() only returns OK with a valid tree connect
       via  3526615 vfs_streams_xattr: use fsp, not base_fsp
       via  7c10e19 libcli/auth: use the correct creds value against servers without LogonSamLogonEx
       via  023fbcb librpc/rpc: fix regression in NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE error mapping
       via  4db119f krb5_wrap: use our own code to calculate the ENCTYPE_ARCFOUR_HMAC key
       via  e29d92c s4:libcli/raw: remove unused DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH
       via  6cc7a29 s3:include: remove unused DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH
       via  746fe43 s3:net_rpc_trust: make use of trust_pw_new_value()
       via  b9eaad8 s3:libnet_join: make use of trust_pw_new_value()
       via  49df7f2 s3:libads: use trust_pw_new_value() for krb5 machine passwords
       via  cb01a46 s3:libsmb: use trust_pw_new_value() in trust_pw_change()
       via  d332077 s3:libsmb: add trust_pw_new_value() helper function
       via  73f8a92 s3:libsmb: let trust_pw_change() verify the new password at the end.
       via  8206490 s3:libsmb: let trust_pw_change() debug more verbose information
       via  b8e5ee1 lib/util: add generate_random_machine_password() function
       via  ebef87a libcli/auth: add netlogon_creds_cli_debug_string()
       via  0269265 libcli/auth: check E_md4hash() result in netlogon_creds_cli_ServerPasswordSet_send()
       via  f2924e9 ctdb-scripts: Initialise CTDB_NFS_CALLOUT in statd-callout
       via  44de4e0 ctdb-tests: Add more comm tests
       via  81130d3 ctdb-common: Fix use-after-free error in comm_fd_handler()
       via  f289980 s3: smbd: Don't loop infinitely on bad-symlink resolution.
       via  c553d9f s3-vfs: Only walk the directory once in open_and_sort_dir()
       via  c6eb182 s3/rpc_server/mdssvc: add attribute "kMDItemContentType"
       via  e38d2dd s3/smbd: check for invalid access_mask smbd_calculate_access_mask()
       via  90c819a selftest: also run test base.createx_access against ad_dc
       via  878f56f s3:librpc: remove bigendian argument from dcerpc_pull_ncacn_packet()
       via  81231af s3: VFS: Don't allow symlink, link or rename on already converted paths.
       via  eeef5e4 s3: VFS: shadow_copy2: Fix usage of saved_errno to only set errno on error.
       via  79c2349 s3: VFS: shadow_copy2: Fix a memory leak in the connectpath function.
       via  eef845b s3: VFS: shadow_copy2: Fix module to work with variable current working directory.
       via  7a83181 s3: VFS: Add utility function check_for_converted_path().
       via  50d3a70 s3: VFS: Ensure shadow:format cannot contain a / path separator.
       via  52439d7 s3: VFS: Allow shadow_copy2_connectpath() to return the cached path derived from $cwd.
       via  0d1a281 s3: VFS: shadow_copy2: Fix chdir to store off the needed private variables.
       via  173bd07 s3: VFS: shadow_copy2: Add two currently unused functions to make pathnames absolute or relative to $cwd.
       via  d9acfc4 s3: VFS: shadow_copy2: Change a parameter name.
       via  6cc2fdb s3: VFS: shadow_copy2: Add a wrapper function to call the original shadow_copy2_strip_snapshot().
       via  aa3a11a s3: VFS: shadow_copy2: Add two new variables to the config data. Not yet used.
       via  65c38d7 s3: VFS: shadow_copy2: Fix length comparison to ensure we don't overstep a length.
       via  0d159a2 s3: VFS: shadow_copy2: Ensure pathnames for parameters are correctly relative and terminated.
       via  847a266 s3: VFS: shadow_copy2: Correctly initialize timestamp and stripped variables.
       via  f9edf3e s3: smbd: Make set_conn_connectpath() call canonicalize_absolute_path().
       via  163234d s3: smbtorture: Add new local test LOCAL-CANONICALIZE-PATH
       via  40f3664 s3: lib: Fix two old, old bugs in set_conn_connectpath(), now in canonicalize_absolute_path().
       via  38e2f4b s3: lib: Add canonicalize_absolute_path().
       via  e3816bb s3: smbd: Correctly canonicalize any incoming shadow copy path.
       via  c808b73 waf: backport finding of pkg-config
       via  1b6b200 s3: VFS: vfs_streams_xattr.c: Make streams_xattr_open() store the same path as streams_xattr_recheck().
       via  f65f081 smbd: Fix "map acl inherit" = yes
       via  bb453f5 s3: vfs: dirsort doesn't handle opendir of "." correctly.
       via  946a4de vfs_fruit: checks wrong AAPL config state and so always uses readdirattr
       via  0c0b893 selftest/Samba3: use "server min protocol = SMB3_00" for "ktest"
       via  36e2d39 s3:smbd: allow "server min protocol = SMB3_00" to go via "SMB 2.???" negprot
       via  6bf5ed9 selftest: add test for global "smb encrypt=off"
       via  caab54e selftest: disable SMB encryption in simpleserver environment
       via  22d5d32 docs: impact of a global "smb encrypt=off" on a share with "smb encrypt=required"
       via  ce51a27 s3/smbd: ensure global "smb encrypt = off" is effective for share with "smb encrypt = desired"
       via  3805e2f s3/smbd: ensure global "smb encrypt = off" is effective for SMB 3.1.1 clients
       via  080ce6e s3/smbd: ensure global "smb encrypt = off" is effective for SMB 1 clients
       via  efd9c8a Merge tag 'samba-4.4.9' into v4-4-test
       via  0a66921 script/release.sh: fix off by 1 error in announce.${tagname}.mail.txt creation
       via  eec4a5d vfs_default: unlock the right file in copy chunk
       via  930667c messaging: Fix dead but not cleaned-up-yet destination sockets
       via  e7fbca8 s3:librpc/gse: make use of gss_krb5_import_cred() instead of gss_acquire_cred()
       via  838be14 s3:librpc/gse: remove unused #ifdef HAVE_GSS_KRB5_IMPORT_CRED
       via  119ddfd s3:librpc/gse: include ccache_name in DEBUG message if krb5_cc_resolve() fails
       via  f9c6dd8 smbd/ioctl: match WS2016 ReFS set compression behaviour
       via  b975c76 torture/ioctl: test set_compression(format_none)
       via  0fba7b2 pam: map more NT password errors to PAM errors
       via  d6b8638 s3: torture: Add test for cli_ftruncate calling cli_smb2_ftruncate.
       via  837a666 s3: libsmb: Add cli_smb2_ftruncate(), plumb into cli_ftruncate().
       via  e29784e selftest: Do not include system krb5.conf in selftest
       via  1283710 s3:libads: Include system /etc/krb5.conf if we use MIT Kerberos
       via  d7568dd s3:param: Add an 'include system krb5 conf' option
       via  1aa6715 VERSION: Bump version up to 4.4.10...
       via  5441c28 VERSION: Disable GIT_SNAPSHOTS for the 4.4.9 release.
       via  c2f0dab WHATSNEW: Add release notes for Samba 4.4.9.
       via  4394780 krb5_wrap: provide CKSUMTYPE_HMAC_SHA1_96_AES_*
       via  748a216 VERSION: Bump version up to 4.4.9...
       via  6df9afa Merge tag 'samba-4.4.8' into v4-4-test
       via  2a69018 VERSION: Disable GIT_SNAPSHOTS for the 4.4.8 release.
       via  2b9cb93 WHATSNEW: Add release notes for Samba 4.4.8.
       via  5ed800f CVE-2016-2126: auth/kerberos: only allow known checksum types in check_pac_checksum()
       via  6362514 CVE-2016-2125: s4:gensec_gssapi: don't use GSS_C_DELEG_FLAG by default
       via  1da911b CVE-2016-2125: s3:gse: avoid using GSS_C_DELEG_FLAG
       via  ac3ce22 CVE-2016-2125: s4:scripting: don't use GSS_C_DELEG_FLAG in nsupdate-gss
       via  4b095f1 CVE-2016-2123: Fix DNS vuln ZDI-CAN-3995
       via  42d2d38 s3: ntlm_auth: Don't corrupt the output stream with debug messages.
       via  29e228c lib: security: se_access_check() incorrectly processes owner rights (S-1-3-4) DENY ace entries
       via  3873681 s3: smbd: Add missing permissions check on destination folder.
       via  6c28575 s3: smbd: Make check_parent_access() available to rename code.
       via  3c2cc97 s3: smbd: rename - missing early error exit if source and destination prefixes are different.
       via  764444d manpages/vfs_fruit: add warning to fruit:resoure=stream
       via  37031cb manpages/vfs_fruit: fruit:resource option misspelling
       via  584107b printing: Fix building with CUPS version older than 1.7
       via  cab4fa0 s3/smbd: fix the last resort check that sets the file type attribute
       via  0703c1b nss_wins: Fix errno values for HOST_NOT_FOUND
       via  1735c35 s4:torture: Fix cleanup of the secrets object in session_key test
       via  a34231a s4:torture: Normalizes names in session_key test
       via  f5fb3c2 s4:torture: Strip trailing whitespaces in session_key.c
       via  fa67920 s4:torture: Add tortue test for AddPrinterDriverEx with COPY_FROM_DIRECTORY
       via  4450467 lib:torture: Make variables const
       via  9a227c7 s3:spoolss: Add support for COPY_FROM_DIRECTORY in AddPrinterDriverEx
       via  8db189b ctdb-recovery: Avoid NULL dereference in failure case
       via  d6c2372 ctdb-locking: Reset real-time priority in lock helper
       via  27653e8 s4-torture: add spoolss_SetPrinter ndr test to validate secdesc_ptr
       via  d5eb003 spoolss: Use correct values for secdesc and devmode pointers
       via  b9f3bc8 build: Fix build with perl on debian sid.
       via  fae4f73 ctdb-tests: Add tests for updated Debian style Samba start/stop
       via  fc465f2 ctdb-scripts: Fix Debian init in samba eventscript
       via  0b56446 s3: delete_streams: Don't jump to fail: - that resets state.
       via  4e80e19 s3-printing: Allow printer names longer than 16 chars
       via  bc8d927 s3-printing: Correctly encode CUPS printer URIs
       via  bf9e460 vfs:glusterfs: preallocate result for glfs_realpath
       via  37e476a s3-winbind: Do not return NO_MEMORY if we have an empty user list
       via  998ca31 provision: Add support for BIND 9.11.x
       via  370a9af dlz-bind: Add support for BIND 9.11.x
       via  50b5454 dlz-bind: Set DNS_CLIENTINFO_VERSION based on BIND version
       via  f93def4 dlz-bind: Fix initialization of DLZ_DLOPEN_AGE
       via  c2a9079 dlz-bind: Fix preprocessor checks for BIND versions
       via  23aac93 ctdb-packaging: Move CTDB tests to /usr/local/share/ctdb/tests/
       via  79bf745 s3:smbd: only pass UCF_PREP_CREATEFILE to filename_convert() if we may create a new file
       via  a0b5a08 Revert "ctdb-common: Use SCHED_RESET_ON_FORK when setting SCHED_FIFO"
       via  6aec65c s3: vfs: streams_depot. Use conn->connectpath not conn->cwd.
       via  aa23db8 ctdb-conn: add missing variable initialization
       via  d6a814c VERSION: Bump version up to 4.4.8...
      from  daef395 VERSION: Disable GIT_SNAPSHOTS for the 4.4.9 release.

https://git.samba.org/?p=samba.git;a=shortlog;h=v4-4-stable


- Log -----------------------------------------------------------------
-----------------------------------------------------------------------

Summary of changes:
 VERSION                                            |   2 +-
 WHATSNEW.txt                                       | 111 ++-
 auth/credentials/credentials_secrets.c             |  17 +-
 ctdb/common/comm.c                                 |  46 +-
 ctdb/config/statd-callout                          |   3 +
 ctdb/tests/cunit/comm_test_001.sh                  |  10 +-
 ctdb/tests/src/comm_test.c                         | 309 ++++++-
 docs-xml/smbdotconf/security/smbencrypt.xml        |   6 +-
 .../smbdotconf/winbind/includesystemkrb5conf.xml   |  15 +
 lib/krb5_wrap/krb5_samba.c                         |  37 +
 lib/util/genrand_util.c                            | 168 +++-
 lib/util/samba_util.h                              |  32 +-
 libcli/auth/netlogon_creds_cli.c                   |  33 +-
 libcli/auth/netlogon_creds_cli.h                   |   4 +
 libcli/auth/pam_errors.c                           |   6 +-
 librpc/rpc/dcerpc_error.c                          |   8 +-
 nsswitch/pam_winbind.c                             |   5 +
 python/samba/tests/docs.py                         |   3 +-
 script/release.sh                                  |   5 +-
 selftest/selftest.pl                               |   1 +
 selftest/target/Samba3.pm                          |   9 +
 source3/include/proto.h                            |   3 +
 source3/include/smb.h                              |   6 -
 source3/lib/messages.c                             |  11 +
 source3/lib/util_path.c                            | 139 ++++
 source3/lib/util_path.h                            |   1 +
 source3/libads/kerberos.c                          |  13 +-
 source3/libads/sasl.c                              |  25 +-
 source3/libads/util.c                              |   9 +-
 source3/libnet/libnet_join.c                       |  16 +-
 source3/librpc/crypto/gse.c                        |  38 +-
 source3/librpc/rpc/dcerpc.h                        |   3 +-
 source3/librpc/rpc/dcerpc_helpers.c                |   9 +-
 source3/libsmb/cli_smb2_fnum.c                     |  65 ++
 source3/libsmb/cli_smb2_fnum.h                     |   3 +
 source3/libsmb/clifile.c                           |   8 +-
 source3/libsmb/trusts_util.c                       | 143 +++-
 source3/modules/vfs_default.c                      |   2 +-
 source3/modules/vfs_dirsort.c                      |  67 +-
 source3/modules/vfs_fruit.c                        |   2 +-
 source3/modules/vfs_shadow_copy2.c                 | 918 +++++++++++++++------
 source3/modules/vfs_streams_xattr.c                |  50 +-
 source3/param/loadparm.c                           |   1 +
 source3/passdb/passdb.c                            |  17 +
 source3/rpc_client/cli_pipe.c                      |   3 +-
 source3/rpc_server/mdssvc/sparql_mapping.c         |   5 +
 .../script/tests/test_smbclient_encryption_off.sh  |  65 ++
 source3/selftest/tests.py                          |  18 +-
 source3/smbd/filename.c                            | 150 ++++
 source3/smbd/negprot.c                             |  23 +-
 source3/smbd/open.c                                | 110 +--
 source3/smbd/posix_acls.c                          |   4 +-
 source3/smbd/service.c                             | 115 +--
 source3/smbd/smb2_ioctl_filesys.c                  |  26 +-
 source3/smbd/smb2_negprot.c                        |   2 +-
 source3/smbd/smb2_tcon.c                           |   3 +-
 source3/torture/proto.h                            |   1 +
 source3/torture/test_smb2.c                        | 160 ++++
 source3/torture/torture.c                          |  45 +
 source3/utils/net_rpc_trust.c                      |   6 +-
 source3/winbindd/winbindd_ads.c                    |   2 +
 source3/winbindd/winbindd_cm.c                     |  99 ++-
 source3/wscript_build                              |   2 +-
 source4/libcli/raw/smb.h                           |   7 -
 source4/torture/smb2/ioctl.c                       |  11 +-
 third_party/waf/wafadmin/Tools/config_c.py         |   4 +-
 66 files changed, 2587 insertions(+), 653 deletions(-)
 create mode 100644 docs-xml/smbdotconf/winbind/includesystemkrb5conf.xml
 create mode 100755 source3/script/tests/test_smbclient_encryption_off.sh


Changeset truncated at 500 lines:

diff --git a/VERSION b/VERSION
index aa1d8a0..6d585b7 100644
--- a/VERSION
+++ b/VERSION
@@ -25,7 +25,7 @@
 ########################################################
 SAMBA_VERSION_MAJOR=4
 SAMBA_VERSION_MINOR=4
-SAMBA_VERSION_RELEASE=9
+SAMBA_VERSION_RELEASE=10
 
 ########################################################
 # If a official release has a serious bug              #
diff --git a/WHATSNEW.txt b/WHATSNEW.txt
index 3f0946c..7f74f34 100644
--- a/WHATSNEW.txt
+++ b/WHATSNEW.txt
@@ -1,3 +1,110 @@
+                   ==============================
+                   Release Notes for Samba 4.4.10
+                            March 1, 2017
+                   ==============================
+
+
+This is the latest stable release of Samba 4.4. Please note that this will
+likely be the last maintenance release of the Samba 4.4 release branch.
+
+Major enhancements in Samba 4.4.10 include:
+
+o  Domain join broken under certain circumstances after winbindd changed the
+   trust password (bug #12262).
+
+A new parameter "include system krb5 conf" has been added (bug #12441). Please
+see the man page for details.
+
+
+Changes since 4.4.9:
+--------------------
+
+o  Jeremy Allison <jra at samba.org>
+   * BUG 12479: s3: libsmb: Add cli_smb2_ftruncate(), plumb into
+     cli_ftruncate().
+   * BUG 12499: s3: vfs: dirsort doesn't handle opendir of "." correctly.
+   * BUG 12572: s3: smbd: Don't loop infinitely on bad-symlink resolution.
+   * BUG 12531: Make vfs_shadow_copy2 cope with server changing directories.
+   * BUG 12546: s3: VFS: vfs_streams_xattr.c: Make streams_xattr_open() store
+     the same path as streams_xattr_recheck().
+
+o  Ralph Boehme <slow at samba.org>
+   * BUG 12536: s3/smbd: Check for invalid access_mask
+     smbd_calculate_access_mask().
+   * BUG 12541: vfs_fruit: checks wrong AAPL config state and so always uses
+     readdirattr.
+   * BUG 12545: s3/rpc_server/mdssvc: Add attribute "kMDItemContentType".
+   * BUG 12591: vfs_streams_xattr: Use fsp, not base_fsp.
+
+o  David Disseldorp <ddiss at samba.org>
+   * BUG 12144: smbd/ioctl: Match WS2016 ReFS set compression behaviour.
+
+o  Amitay Isaacs <amitay at gmail.com>
+   * BUG 12580: ctdb-common: Fix use-after-free error in comm_fd_handler().
+
+o  Björn Jacke <bj at sernet.de>
+   * BUG 2210: pam: Map more NT password errors to PAM errors.
+   * BUG 12535: vfs_default: Unlock the right file in copy chunk.
+
+o  Volker Lendecke <vl at samba.org>
+   * BUG 12509: messaging: Fix dead but not cleaned-up-yet destination sockets.
+   * BUG 12551: smbd: Fix "map acl inherit" = yes.
+
+o  Stefan Metzmacher <metze at samba.org>
+   * BUG 11830: Domain member cannot resolve trusted domains' users.
+   * BUG 12262: Domain join broken under certain circumstances after winbindd
+     changed the trust password.
+   * BUG 12480: 'kinit' succeeded, but ads_sasl_spnego_gensec_bind(KRB5) failed: An
+     internal error occurred (with MIT krb5).
+   * BUG 12540: s3:smbd: allow "server min protocol = SMB3_00" to go via "SMB
+     2.???" negprot.
+   * BUG 12581: 'smbclient' fails on bad endianess when listing shares from
+     Solaris kernel SMB server on SPARC.
+   * BUG 12585: librpc/rpc: fix regression in
+     NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE error mapping.
+   * BUG 12586: netlogon_creds_cli_LogonSamLogon doesn't work without
+     netr_LogonSamLogonEx.
+   * BUG 12587: Fix winbindd child segfaults on connect to an NT4 domain.
+   * BUG 12588: cm_prepare_connection may return NT_STATUS_OK without a valid
+     connection.
+   * BUG 12598: winbindd (as member) requires kerberos against trusted ad domain,
+     while it shouldn't.
+
+o  Andreas Schneider <asn at samba.org>
+   * BUG 12441: s3:libads: Include system /etc/krb5.conf if we use MIT Kerberos.
+   * BUG 12571: s3-vfs: Only walk the directory once in open_and_sort_dir().
+
+o  Martin Schwenke <martin at meltin.net>
+   * BUG 12589: CTDB statd-callout does not cause grace period when
+     CTDB_NFS_CALLOUT="".
+
+o  Uri Simchoni <uri at samba.org>
+   * BUG 12529: waf: Backport finding of pkg-config.
+
+
+#######################################
+Reporting bugs & Development Discussion
+#######################################
+
+Please discuss this release on the samba-technical mailing list or by
+joining the #samba-technical IRC channel on irc.freenode.net.
+
+If you do report problems then please try to send high quality
+feedback. If you don't provide vital information to help us track down
+the problem then you will probably be ignored.  All bug reports should
+be filed under the "Samba 4.1 and newer" product in the project's Bugzilla
+database (https://bugzilla.samba.org/).
+
+
+======================================================================
+== Our Code, Our Bugs, Our Responsibility.
+== The Samba Team
+======================================================================
+
+
+Release notes for older releases follow:
+----------------------------------------
+
                    =============================
                    Release Notes for Samba 4.4.9
                            January 2, 2017
@@ -77,8 +184,8 @@ database (https://bugzilla.samba.org/).
 ======================================================================
 
 
-Release notes for older releases follow:
-----------------------------------------
+----------------------------------------------------------------------
+
 
                    =============================
                    Release Notes for Samba 4.4.8
diff --git a/auth/credentials/credentials_secrets.c b/auth/credentials/credentials_secrets.c
index 784e345..d36913a 100644
--- a/auth/credentials/credentials_secrets.c
+++ b/auth/credentials/credentials_secrets.c
@@ -39,7 +39,7 @@
 #include "dbwrap/dbwrap.h"
 #include "dbwrap/dbwrap_open.h"
 #include "lib/util/util_tdb.h"
-
+#include "libds/common/roles.h"
 
 /**
  * Fill in credentials for the machine trust account, from the secrets database.
@@ -277,6 +277,8 @@ _PUBLIC_ NTSTATUS cli_credentials_set_machine_account_db_ctx(struct cli_credenti
 	char *secrets_tdb_password = NULL;
 	char *secrets_tdb_old_password = NULL;
 	uint32_t secrets_tdb_secure_channel_type = SEC_CHAN_NULL;
+	int server_role = lpcfg_server_role(lp_ctx);
+	int security = lpcfg_security(lp_ctx);
 	char *keystr;
 	char *keystr_upper = NULL;
 	TALLOC_CTX *tmp_ctx = talloc_named(cred, 0, "cli_credentials_set_secrets from ldb");
@@ -355,13 +357,26 @@ _PUBLIC_ NTSTATUS cli_credentials_set_machine_account_db_ctx(struct cli_credenti
 	}
 
 	if (secrets_tdb_password_more_recent) {
+		enum credentials_use_kerberos use_kerberos = CRED_DONT_USE_KERBEROS;
 		char *machine_account = talloc_asprintf(tmp_ctx, "%s$", lpcfg_netbios_name(lp_ctx));
 		cli_credentials_set_password(cred, secrets_tdb_password, CRED_SPECIFIED);
 		cli_credentials_set_old_password(cred, secrets_tdb_old_password, CRED_SPECIFIED);
 		cli_credentials_set_domain(cred, domain, CRED_SPECIFIED);
 		if (strequal(domain, lpcfg_workgroup(lp_ctx))) {
 			cli_credentials_set_realm(cred, lpcfg_realm(lp_ctx), CRED_SPECIFIED);
+
+			switch (server_role) {
+			case ROLE_DOMAIN_MEMBER:
+				if (security != SEC_ADS) {
+					break;
+				}
+				/* fall through */
+			case ROLE_ACTIVE_DIRECTORY_DC:
+				use_kerberos = CRED_AUTO_USE_KERBEROS;
+				break;
+			}
 		}
+		cli_credentials_set_kerberos_state(cred, use_kerberos);
 		cli_credentials_set_username(cred, machine_account, CRED_SPECIFIED);
 		cli_credentials_set_password_last_changed_time(cred, secrets_tdb_lct);
 		cli_credentials_set_secure_channel_type(cred, secrets_tdb_secure_channel_type);
diff --git a/ctdb/common/comm.c b/ctdb/common/comm.c
index 1bbb460..6b71c0f 100644
--- a/ctdb/common/comm.c
+++ b/ctdb/common/comm.c
@@ -262,14 +262,22 @@ static void comm_read_failed(struct tevent_req *req)
  * Write packets
  */
 
+struct comm_write_entry {
+	struct comm_context *comm;
+	struct tevent_queue_entry *qentry;
+	struct tevent_req *req;
+};
+
 struct comm_write_state {
 	struct tevent_context *ev;
 	struct comm_context *comm;
+	struct comm_write_entry *entry;
 	struct tevent_req *subreq;
 	uint8_t *buf;
 	size_t buflen, nwritten;
 };
 
+static int comm_write_entry_destructor(struct comm_write_entry *entry);
 static void comm_write_trigger(struct tevent_req *req, void *private_data);
 static void comm_write_done(struct tevent_req *subreq);
 
@@ -280,6 +288,7 @@ struct tevent_req *comm_write_send(TALLOC_CTX *mem_ctx,
 {
 	struct tevent_req *req;
 	struct comm_write_state *state;
+	struct comm_write_entry *entry;
 
 	req = tevent_req_create(mem_ctx, &state, struct comm_write_state);
 	if (req == NULL) {
@@ -291,15 +300,38 @@ struct tevent_req *comm_write_send(TALLOC_CTX *mem_ctx,
 	state->buf = buf;
 	state->buflen = buflen;
 
-	if (!tevent_queue_add_entry(comm->queue, ev, req,
-				    comm_write_trigger, NULL)) {
-		talloc_free(req);
-		return NULL;
+	entry = talloc_zero(state, struct comm_write_entry);
+	if (tevent_req_nomem(entry, req)) {
+		return tevent_req_post(req, ev);
 	}
 
+	entry->comm = comm;
+	entry->req = req;
+	entry->qentry = tevent_queue_add_entry(comm->queue, ev, req,
+					       comm_write_trigger, NULL);
+	if (tevent_req_nomem(entry->qentry, req)) {
+		return tevent_req_post(req, ev);
+	}
+
+	state->entry = entry;
+	talloc_set_destructor(entry, comm_write_entry_destructor);
+
 	return req;
 }
 
+static int comm_write_entry_destructor(struct comm_write_entry *entry)
+{
+	struct comm_context *comm = entry->comm;
+
+	if (comm->write_req == entry->req) {
+		comm->write_req = NULL;
+		TEVENT_FD_NOT_WRITEABLE(comm->fde);
+	}
+
+	TALLOC_FREE(entry->qentry);
+	return 0;
+}
+
 static void comm_write_trigger(struct tevent_req *req, void *private_data)
 {
 	struct comm_write_state *state = tevent_req_data(
@@ -344,6 +376,8 @@ static void comm_write_done(struct tevent_req *subreq)
 	}
 
 	state->nwritten = nwritten;
+	state->entry->qentry = NULL;
+	TALLOC_FREE(state->entry);
 	tevent_req_done(req);
 }
 
@@ -393,8 +427,8 @@ static void comm_fd_handler(struct tevent_context *ev,
 		struct comm_write_state *write_state;
 
 		if (comm->write_req == NULL) {
-			/* This should never happen */
-			abort();
+			TEVENT_FD_NOT_WRITEABLE(comm->fde);
+			return;
 		}
 
 		write_state = tevent_req_data(comm->write_req,
diff --git a/ctdb/config/statd-callout b/ctdb/config/statd-callout
index a923d8a..9fbf821 100755
--- a/ctdb/config/statd-callout
+++ b/ctdb/config/statd-callout
@@ -121,6 +121,9 @@ case "$1" in
 	# where the lock manager will respond "strangely" immediately
 	# after restarting it, which causes clients to fail to reclaim
 	# their locks.
+	if [ -z "$CTDB_NFS_CALLOUT" ] ; then
+		CTDB_NFS_CALLOUT="${CTDB_BASE}/nfs-linux-kernel-callout"
+	fi
 	"$CTDB_NFS_CALLOUT" "stop" "nlockmgr" >/dev/null 2>&1
         sleep 2
 	"$CTDB_NFS_CALLOUT" "start" "nlockmgr" >/dev/null 2>&1
diff --git a/ctdb/tests/cunit/comm_test_001.sh b/ctdb/tests/cunit/comm_test_001.sh
index 5d20db2..ac09f5c 100755
--- a/ctdb/tests/cunit/comm_test_001.sh
+++ b/ctdb/tests/cunit/comm_test_001.sh
@@ -2,6 +2,12 @@
 
 . "${TEST_SCRIPTS_DIR}/unit.sh"
 
-ok "100 2048 500 4096 1024 8192 200 16384 300 32768 400 65536 1048576 "
 
-unit_test comm_test
+ok_null
+unit_test comm_test 1
+
+ok_null
+unit_test comm_test 2
+
+ok "100 2048 500 4096 1024 8192 200 16384 300 32768 400 65536 1048576 "
+unit_test comm_test 3
diff --git a/ctdb/tests/src/comm_test.c b/ctdb/tests/src/comm_test.c
index 2189435..5e1d694 100644
--- a/ctdb/tests/src/comm_test.c
+++ b/ctdb/tests/src/comm_test.c
@@ -26,7 +26,218 @@
 #include "common/pkt_write.c"
 #include "common/comm.c"
 
-static void dead_handler(void *private_data)
+/*
+ * Test read_handler and dead_handler
+ */
+
+static void test1_read_handler(uint8_t *buf, size_t buflen,
+			       void *private_data)
+{
+	int *result = (int *)private_data;
+
+	*result = -1;
+}
+
+static void test1_dead_handler(void *private_data)
+{
+	int *result = (int *)private_data;
+
+	*result = 1;
+}
+
+static void test1(void)
+{
+	TALLOC_CTX *mem_ctx;
+	struct tevent_context *ev;
+	struct comm_context *comm;
+	int fd[2];
+	int result = 0;
+	uint32_t data[2];
+	int ret;
+	ssize_t n;
+
+	mem_ctx = talloc_new(NULL);
+	assert(mem_ctx != NULL);
+
+	ev = tevent_context_init(mem_ctx);
+	assert(ev != NULL);
+
+	ret = pipe(fd);
+	assert(ret == 0);
+
+	ret = comm_setup(ev, ev, fd[0], test1_read_handler, &result,
+			 test1_dead_handler, &result, &comm);
+	assert(ret == 0);
+
+	data[0] = 2 * sizeof(uint32_t);
+	data[1] = 0;
+
+	n = write(fd[1], (void *)&data, data[0]);
+	assert(n == data[0]);
+
+	while (result == 0) {
+		tevent_loop_once(ev);
+	}
+
+	assert(result == -1);
+
+	result = 0;
+	close(fd[1]);
+
+	while (result == 0) {
+		tevent_loop_once(ev);
+	}
+
+	assert(result == 1);
+
+	talloc_free(mem_ctx);
+}
+
+/*
+ * Test that the tevent_req returned by comm_write_send() can be free'd.
+ */
+
+struct test2_state {
+	TALLOC_CTX *mem_ctx;
+	bool done;
+};
+
+static void test2_read_handler(uint8_t *buf, size_t buflen,
+			       void *private_data)
+{
+	struct test2_state *state = (struct test2_state *)private_data;
+
+	TALLOC_FREE(state->mem_ctx);
+}
+
+static void test2_dead_handler(void *private_data)
+{
+	abort();
+}
+
+struct test2_write_state {
+	int count;
+};
+
+static void test2_write_done(struct tevent_req *subreq);
+
+static struct tevent_req *test2_write_send(TALLOC_CTX *mem_ctx,
+					   struct tevent_context *ev,
+					   struct comm_context *comm,
+					   uint8_t *buf, size_t buflen)
+{
+	struct tevent_req *req, *subreq;
+	struct test2_write_state *state;
+	int i;
+
+	req = tevent_req_create(mem_ctx, &state, struct test2_write_state);
+	if (req == NULL) {
+		return NULL;
+	}
+
+	state->count = 0;
+
+	for (i=0; i<10; i++) {
+		subreq = comm_write_send(state, ev, comm, buf, buflen);
+		if (tevent_req_nomem(subreq, req)) {
+			return tevent_req_post(req, ev);
+		}
+		tevent_req_set_callback(subreq, test2_write_done, req);
+	}
+
+	return req;
+}
+
+static void test2_write_done(struct tevent_req *subreq)
+{
+	struct tevent_req *req = tevent_req_callback_data(
+		subreq, struct tevent_req);
+	struct test2_write_state *state = tevent_req_data(
+		req, struct test2_write_state);
+	bool status;
+	int ret;
+
+	status = comm_write_recv(subreq, &ret);
+	TALLOC_FREE(subreq);
+	if (! status) {
+		tevent_req_error(req, ret);
+		return;
+	}
+
+	state->count += 1;
+
+	if (state->count == 10) {
+		tevent_req_done(req);
+	}
+}
+
+static void test2_timer_handler(struct tevent_context *ev,
+				struct tevent_timer *te,
+				struct timeval cur_time,
+				void *private_data)
+{
+	struct test2_state *state = (struct test2_state *)private_data;
+
+	state->done = true;
+}
+
+static void test2(void)
+{
+	TALLOC_CTX *mem_ctx;
+	struct tevent_context *ev;
+	struct comm_context *comm_reader, *comm_writer;
+	struct test2_state test2_state;
+	struct tevent_req *req;
+	struct tevent_timer *te;
+	int fd[2];
+	uint32_t data[2];
+	int ret;
+
+	mem_ctx = talloc_new(NULL);
+	assert(mem_ctx != NULL);
+
+	test2_state.mem_ctx = talloc_new(mem_ctx);
+	assert(test2_state.mem_ctx != NULL);


-- 
Samba Shared Repository



More information about the samba-cvs mailing list