From jra at samba.org  Tue Dec  1 20:30:13 2020
From: jra at samba.org (Jeremy Allison)
Date: Tue,  1 Dec 2020 20:30:13 +0000 (UTC)
Subject: [SCM] Samba Shared Repository - branch master updated
Message-ID: <20201201203013.605B31404CA@sn.samba.org>

The branch, master has been updated
       via  936f74daed0 vfs_zfsacl: add missing inherited flag on hidden "magic" everyone@ ACE
       via  a8457ac3c80 vfs_zfsacl: reformatting
       via  89e2d68bb4d selftest: Remove samba3.blackbox.smbclient_tar from flapping tests
       via  20e0ce50884 clitar: Use do_list()'s recursion in clitar.c
       via  16ffa17ee28 s3/script/tests: Ensure all remote test files are removed
       via  6c7dc4959fd s3/script/tests: call smbclient deltree to remove remote files
       via  363bfa4e1ca s3/script/tests: Make smb_client 'die' behaviour configurable
       via  99ffa4a9828 s3/script/tests: Remove make_path (for remote dir)
       via  6f246658cf0 selftest: make samba3.blackbox.smbclient_tar runnable (even manually)
       via  4bb3bffa4b7 s3/script/tests: Fix samba3.blackbox.smbclient_tarmode cleanup
       via  fec1f8faffd s3/script: Use smbclient deltree to clean up smbclient_tarmode subdir
       via  be8dca68f89 s3/script/tests: Use tarmode share for samba3.blackbox.smbclient_tar*
       via  6cb0a00f4ab s3/script/test: Use different testdir for samba3.blackbox.smbclient_tarmode
       via  a250f733669 selftest: Add a new tarmode shares
       via  4f5a7f11b77 s3/script/tests: Fix 'Unrecognized option(s) passed to mkpath()' error
      from  b09f0bb4d40 test: Fix the FreeBSD build

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 936f74daed0d6221312f651f35c4ed357bbf1414
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Nov 30 12:28:58 2020 +0100

    vfs_zfsacl: add missing inherited flag on hidden "magic" everyone@ ACE
    
    This was an omission in the fixes for bug 14470.
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14587
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>
    
    Autobuild-User(master): Jeremy Allison <jra at samba.org>
    Autobuild-Date(master): Tue Dec  1 20:29:34 UTC 2020 on sn-devel-184

commit a8457ac3c80e22588e33a343c2306b702734ca88
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Nov 30 12:28:00 2020 +0100

    vfs_zfsacl: reformatting
    
    No change in behaviour.
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14587
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 89e2d68bb4d93dc391af97f35ff1148aec7930b0
Author: Noel Power <noel.power at suse.com>
Date:   Mon Nov 30 09:21:50 2020 +0000

    selftest: Remove samba3.blackbox.smbclient_tar from flapping tests
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14581
    
    Signed-off-by: Noel Power <noel.power at suse.com>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 20e0ce508844fec2dd0011423b10484dc7ccfdb7
Author: Volker Lendecke <vl at samba.org>
Date:   Tue Dec 1 08:58:14 2020 +0100

    clitar: Use do_list()'s recursion in clitar.c
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14581
    
    Signed-off-by: Volker Lendecke <vl at samba.org>
    Reviewed-by: Aurelien Aptel <aaptel at samba.org>
    Reviewed-by: Noel Power <noel.power at suse.com>

commit 16ffa17ee28edfc3bc70c66abf41b5518aeab8fe
Author: Jeremy Allison <jra at samba.org>
Date:   Mon Nov 30 17:19:29 2020 +0000

    s3/script/tests: Ensure all remote test files are removed
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14581
    
    Signed-off-by: Jeremy Allison <jra at samba.org>
    Reviewed-by: Noel Power <noel.power at suse.com>

commit 6c7dc4959fd5de4382aee413b4cc711cc6f281f4
Author: Noel Power <noel.power at suse.com>
Date:   Mon Nov 30 10:41:57 2020 +0000

    s3/script/tests: call smbclient deltree to remove remote files
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14581
    
    Signed-off-by: Noel Power <noel.power at suse.com>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 363bfa4e1ca10e64057a6d04d6faff7c788db89d
Author: Noel Power <noel.power at suse.com>
Date:   Mon Nov 30 10:18:32 2020 +0000

    s3/script/tests: Make smb_client 'die' behaviour configurable
    
    smb_client behaviour is to die if there is an error. This is
    a little heavy handed and make it impossible for example to
    use smb_client to run a command that might fail (where such
    a failure isn't really an error) E.G. Calling deltree and
    the directory doesn't exist
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14581
    
    Signed-off-by: Noel Power <noel.power at suse.com>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 99ffa4a98287f125e45690e87b32616f4d4254e4
Author: Noel Power <noel.power at suse.com>
Date:   Mon Nov 30 09:59:58 2020 +0000

    s3/script/tests: Remove make_path (for remote dir)
    
    LOCALPATH is actually the local path to the share, we should
    not need to create the share path (it should already exist)
    
    Note: When we remove the tree located at LOCALPATH we keep the root
          so the share path should always be there
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14581
    
    Signed-off-by: Noel Power <noel.power at suse.com>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 6f246658cf003f7e2f393f7b7490d9e8ae84e21c
Author: Noel Power <noel.power at suse.com>
Date:   Mon Nov 30 11:15:06 2020 +0000

    selftest: make samba3.blackbox.smbclient_tar runnable (even manually)
    
    samba3.blackbox.smbclient_tar is marked as flapping so it
    seems we have missed that it has stopped working. The local path
    passed to script/tests/test_smbclient_tarmode.pl must point to a
    valid share
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14581
    
    Signed-off-by: Noel Power <noel.power at suse.com>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 4bb3bffa4b7a770d36138c45f717a9048ef82cff
Author: Noel Power <noel.power at suse.com>
Date:   Mon Nov 30 17:39:25 2020 +0000

    s3/script/tests: Fix samba3.blackbox.smbclient_tarmode cleanup
    
    Make sure samba3.blackbox.smbclient_tarmode removes data files
    not just before running the test but also after
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14581
    
    Signed-off-by: Noel Power <noel.power at suse.com>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit fec1f8faffd9eb1aae77e7c515e57897be34a255
Author: Noel Power <noel.power at suse.com>
Date:   Fri Nov 27 15:52:27 2020 +0000

    s3/script: Use smbclient deltree to clean up smbclient_tarmode subdir
    
    Replace rm -rf of local dir (that is hosted remotely)
    with smbclient deltree
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14581
    
    Signed-off-by: Noel Power <noel.power at suse.com>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit be8dca68f89f110ef5947e0c2a7258554772cf9a
Author: Noel Power <noel.power at suse.com>
Date:   Fri Nov 27 15:33:26 2020 +0000

    s3/script/tests: Use tarmode share for samba3.blackbox.smbclient_tar*
    
    After this change both samba3.blackbox.smbclient_tar &
    samba3.blackbox.smbclient_tarmode now use the same dedicated share
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14581
    
    Signed-off-by: Noel Power <noel.power at suse.com>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 6cb0a00f4ab4bc1a8193d50cc076ec7174a5ece9
Author: Noel Power <noel.power at suse.com>
Date:   Fri Nov 27 15:25:21 2020 +0000

    s3/script/test: Use different testdir for samba3.blackbox.smbclient_tarmode
    
    The other tarmode torture test samba3.blackbox.smbclient_tar now uses a share
    'tarmode' which uses the same source path as samba3.blackbox.smbclient_tarmode
    
    Avoid conflicting paths and use a new subdir (of the test share) called
    'smbclient_tarmode'
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14581
    
    Signed-off-by: Noel Power <noel.power at suse.com>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit a250f73366983d2a7397608a611f295f10dbb548
Author: Noel Power <noel.power at suse.com>
Date:   Thu Nov 26 17:31:50 2020 +0000

    selftest: Add a new tarmode shares
    
    samba3.blackbox.smbclient_tar & samba3.blackbox.smbclient_tar
    need separate shares with own xattr tdb(s)
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14581
    
    Signed-off-by: Noel Power <noel.power at suse.com>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 4f5a7f11b7732c3efb511e68f6b9d434d59bb3e8
Author: Noel Power <noel.power at suse.com>
Date:   Fri Nov 27 12:01:49 2020 +0000

    s3/script/tests: Fix 'Unrecognized option(s) passed to mkpath()' error
    
    'keep_root' is an unrecognised option for make_path/mkpath
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14581
    
    Signed-off-by: Noel Power <noel.power at suse.com>
    Reviewed-by: Jeremy Allison <jra at samba.org>

-----------------------------------------------------------------------

Summary of changes:
 selftest/flapping                              |  1 -
 selftest/target/Samba3.pm                      | 11 +++++
 source3/client/clitar.c                        | 41 ++++-------------
 source3/modules/vfs_zfsacl.c                   |  6 ++-
 source3/script/tests/test_smbclient_tarmode.pl | 62 ++++++++++++++++++++++----
 source3/script/tests/test_smbclient_tarmode.sh | 29 ++++++++----
 source3/selftest/tests.py                      | 12 ++---
 7 files changed, 102 insertions(+), 60 deletions(-)


Changeset truncated at 500 lines:

diff --git a/selftest/flapping b/selftest/flapping
index c9f0adbf1bd..8c3f9e8969a 100644
--- a/selftest/flapping
+++ b/selftest/flapping
@@ -31,6 +31,5 @@
 # This test just is not reliable in finding the max search limit
 #
 ^samba4.ldap.notification.python\(.*\).__main__.LDAPNotificationTest.test_max_search
-^samba3.blackbox.smbclient_tar.* # fails very, very often on sn-devel
 ^samba3.blackbox.smbclient_s3.*.sending a message to the remote server # flakey on sn-devel-104 and sn-devel-144
 ^samba3.blackbox.smbclient_s3.*.creating a good symlink and deleting it by path # flakey on sn-devel-104 and sn-devel-144
diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm
index 5623e2a149f..8b1d809c941 100755
--- a/selftest/target/Samba3.pm
+++ b/selftest/target/Samba3.pm
@@ -1369,6 +1369,9 @@ sub setup_fileserver
 	my $tarmode_sharedir="$share_dir/tarmode";
 	push(@dirs,$tarmode_sharedir);
 
+	my $tarmode2_sharedir="$share_dir/tarmode2";
+	push(@dirs,$tarmode2_sharedir);
+
 	my $smbcacls_sharedir="$share_dir/smbcacls";
 	push(@dirs,$smbcacls_sharedir);
 
@@ -1397,6 +1400,14 @@ sub setup_fileserver
 
 	get quota command = $prefix_abs/getset_quota.py
 	set quota command = $prefix_abs/getset_quota.py
+[tarmode]
+	path = $tarmode_sharedir
+	comment = tar test share
+	xattr_tdb:file = $prefix_abs/tarmode-xattr.tdb
+[tarmode2]
+	path = $tarmode2_sharedir
+	comment = tar test share
+	xattr_tdb:file = $prefix_abs/tarmode2-xattr.tdb
 [spotlight]
 	path = $share_dir
 	spotlight = yes
diff --git a/source3/client/clitar.c b/source3/client/clitar.c
index 3fe3622aba6..4fd1f3c47d9 100644
--- a/source3/client/clitar.c
+++ b/source3/client/clitar.c
@@ -711,7 +711,7 @@ static int tar_create(struct tar* t)
 			goto out_close;
 		}
 		DBG(5, ("tar_process do_list with mask: %s\n", mask));
-		status = do_list(mask, TAR_DO_LIST_ATTR, get_file_callback, false, true);
+		status = do_list(mask, TAR_DO_LIST_ATTR, get_file_callback, true, true);
 		if (!NT_STATUS_IS_OK(status)) {
 			DBG(0, ("do_list fail %s\n", nt_errstr(status)));
 			err = 1;
@@ -806,7 +806,7 @@ static int tar_create_from_list(struct tar *t)
 			DBG(5, ("cd '%s' before do_list\n", base));
 			client_set_cur_dir(base);
 		}
-		status = do_list(mask, TAR_DO_LIST_ATTR, get_file_callback, false, true);
+		status = do_list(mask, TAR_DO_LIST_ATTR, get_file_callback, true, true);
 		if (base != NULL) {
 			client_set_cur_dir(start_dir);
 		}
@@ -837,7 +837,7 @@ static NTSTATUS get_file_callback(struct cli_state *cli,
 	char *remote_name;
 	char *old_dir = NULL;
 	char *new_dir = NULL;
-	const char *initial_dir = client_get_cur_dir();
+	const char *initial_dir = dir;
 	bool skip = false;
 	bool isdir;
 	int rc;
@@ -846,7 +846,7 @@ static NTSTATUS get_file_callback(struct cli_state *cli,
 		return NT_STATUS_NO_MEMORY;
 	}
 
-	remote_name = talloc_asprintf(ctx, "%s%s", initial_dir, finfo->name);
+	remote_name = talloc_asprintf(ctx, "%s\\%s", initial_dir, finfo->name);
 	if (remote_name == NULL) {
 		status = NT_STATUS_NO_MEMORY;
 		goto out;
@@ -884,35 +884,10 @@ static NTSTATUS get_file_callback(struct cli_state *cli,
 		goto out;
 	}
 
-	if (isdir) {
-		char *mask;
-		mask = talloc_asprintf(ctx, "%s*", new_dir);
-		if (mask == NULL) {
-			status = NT_STATUS_NO_MEMORY;
-			goto out;
-		}
-		mask = client_clean_name(ctx, mask);
-		if (mask == NULL) {
-			status = NT_STATUS_NO_MEMORY;
-			goto out;
-		}
-
-		rc = tar_get_file(&tar_ctx, remote_name, finfo);
-		if (rc != 0) {
-			status = NT_STATUS_UNSUCCESSFUL;
-			goto out;
-		}
-
-		client_set_cur_dir(new_dir);
-		do_list(mask, TAR_DO_LIST_ATTR, get_file_callback, false, true);
-		client_set_cur_dir(old_dir);
-		tar_ctx.numdir++;
-	} else {
-		rc = tar_get_file(&tar_ctx, remote_name, finfo);
-		if (rc != 0) {
-			status = NT_STATUS_UNSUCCESSFUL;
-			goto out;
-		}
+	rc = tar_get_file(&tar_ctx, remote_name, finfo);
+	if (rc != 0) {
+		status = NT_STATUS_UNSUCCESSFUL;
+		goto out;
 	}
 
 out:
diff --git a/source3/modules/vfs_zfsacl.c b/source3/modules/vfs_zfsacl.c
index 093eb5111e1..fba7253bbef 100644
--- a/source3/modules/vfs_zfsacl.c
+++ b/source3/modules/vfs_zfsacl.c
@@ -219,8 +219,10 @@ static bool zfs_process_smbacl(vfs_handle_struct *handle, files_struct *fsp,
 	}
 	if (must_add_empty_ace) {
 		acebuf[i].a_type = SMB_ACE4_ACCESS_ALLOWED_ACE_TYPE;
-		acebuf[i].a_flags = SMB_ACE4_DIRECTORY_INHERIT_ACE| \
-				    SMB_ACE4_FILE_INHERIT_ACE|ACE_EVERYONE;
+		acebuf[i].a_flags = SMB_ACE4_DIRECTORY_INHERIT_ACE |
+			SMB_ACE4_FILE_INHERIT_ACE |
+			ACE_EVERYONE |
+			ACE_INHERITED_ACE;
 		acebuf[i].a_access_mask = 0;
 		i++;
 	}
diff --git a/source3/script/tests/test_smbclient_tarmode.pl b/source3/script/tests/test_smbclient_tarmode.pl
index 877eec45cc8..bdbbd1a44a8 100755
--- a/source3/script/tests/test_smbclient_tarmode.pl
+++ b/source3/script/tests/test_smbclient_tarmode.pl
@@ -1,5 +1,4 @@
 #!/usr/bin/perl
-
 # Unix SMB/CIFS implementation.
 # Test suite for the tar backup mode of smbclient.
 # Copyright (C) Aur?lien Aptel 2013
@@ -304,6 +303,8 @@ sub test_creation_attr {
     @inc = grep { $_->attr('a') && !$_->attr_any('h', 's') } @all;
     smb_tar('tarmode inc nohidden nosystem', '-Tc', $TAR, $DIR);
     $err += check_tar($TAR, \@inc);
+    # adjust attr so remote files can be deleted with deltree
+    File::walk(sub { $_->set_attr(qw/n r s h/) }, File::tree($DIR));
 
     $err;
 }
@@ -399,7 +400,10 @@ sub test_creation_incremental {
     } else {
         smb_tar('', '-Tcg', $TAR, $DIR);
     }
-    return check_tar($TAR, \@files);
+    my $res = check_tar($TAR, \@files);
+    # adjust attr so remote files can be deleted with deltree
+    File::walk(sub { $_->set_attr(qw/n r s h/) }, File::tree($DIR));
+    return $res
 }
 
 
@@ -917,8 +921,22 @@ Remove all files in the server C<$DIR> (not root)
 sub reset_remote {
     # remove_tree($LOCALPATH . '/'. $DIR);
     # make_path($LOCALPATH . '/'. $DIR);
-    remove_tree($LOCALPATH, {keep_root => 1});
-    make_path($LOCALPATH, {keep_root => 1});
+    my $DIR;
+    my @names;
+    my $name;
+
+    smb_client_cmd(0, '-c', "deltree ./*");
+
+    # Ensure all files are gone.
+
+    opendir(DIR,$LOCALPATH) or die "Can't open $LOCALPATH\n";
+    @names = readdir(DIR) or die "Unable to read $LOCALPATH\n";
+    closedir(DIR);
+    foreach $name (@names) {
+	next if ($name eq ".");   # skip the current directory entry
+	next if ($name eq "..");  # skip the parent  directory entry
+	die "$LOCALPATH not empty\n";
+    }
 }
 
 =head3 C<reset_tmp( )>
@@ -1120,7 +1138,9 @@ sub check_tar {
     return (@more + @less + @diff); # nb of errors
 }
 
-=head3 C<smb_client ( @args )>
+=head3 C<smb_client_cmd( $will_die, @args)>
+
+=head3 C<smb_client_cmd( 0, '-c', 'deltree', $somedir )>
 
 Run smbclient with C<@args> passed as argument and return output.
 
@@ -1131,11 +1151,12 @@ the command-line are already inserted.
 
 The output contains both the C<STDOUT> and C<STDERR>.
 
-Die if smbclient crashes or exits with an error code.
+if C<$will_die> then Die if smbclient crashes or exits with an error code.
+otherwise return output
 
 =cut
-sub smb_client {
-    my (@args) = @_;
+sub smb_client_cmd {
+    my ($will_die, @args) = @_;
 
     my $fullpath = "//$HOST/$SHARE";
     my $cmd = sprintf("%s %s %s",
@@ -1168,11 +1189,34 @@ sub smb_client {
     }
 
     if ($err) {
-        die "ERROR: $errstr";
+	if ($will_die) {
+		die "ERROR: $errstr";
+	} else {
+		say "ERROR: $errstr";
+	}
     }
     return $out;
 }
 
+=head3 C<smb_client ( @args )>
+
+Run smbclient with C<@args> passed as argument and return output.
+
+Each element of C<@args> becomes one escaped argument of smbclient.
+
+Host, share, user, password and the additionnal arguments provided on
+the command-line are already inserted.
+
+The output contains both the C<STDOUT> and C<STDERR>.
+
+Die if smbclient crashes or exits with an error code.
+
+=cut
+sub smb_client {
+    my (@args) = @_;
+    return smb_client_cmd(1, @args)
+}
+
 sub smb_cmd {
     return smb_client('-c', join(' ', @_));
 }
diff --git a/source3/script/tests/test_smbclient_tarmode.sh b/source3/script/tests/test_smbclient_tarmode.sh
index 3779c38a5ca..8bc5b9947cf 100755
--- a/source3/script/tests/test_smbclient_tarmode.sh
+++ b/source3/script/tests/test_smbclient_tarmode.sh
@@ -94,7 +94,7 @@ test_tarmode_creation() {
 	# Clear temp data
 	rm -rf -- "$PREFIX"/tarmode > /dev/null 2>&1
 	rm -f "$PREFIX"/tarmode.tar > /dev/null 2>&1
-	rm -rf "$LOCAL_PATH" > /dev/null 2>&1
+	$SMBCLIENT //$SERVER/tarmode $CONFIGURATION -U$USERNAME%$PASSWORD -c "deltree smbclient_tar"
 
 	# Build the test data
 	if ! create_test_data "$LOCAL_PATH"; then
@@ -104,14 +104,15 @@ test_tarmode_creation() {
 	fi
 
 	# Create tarfile with smbclient
-	if ! $SMBCLIENT //$SERVER/tmp $CONFIGURATION -U$USERNAME%$PASSWORD -I $SERVER_IP -p 139 \
-			$ADDARGS -c "tarmode full" -Tc "$PREFIX/tarmode.tar" "/tarmode"; then
+	if ! $SMBCLIENT //$SERVER/tarmode $CONFIGURATION -U$USERNAME%$PASSWORD -I $SERVER_IP -p 139 \
+			$ADDARGS -c "tarmode full" -Tc "$PREFIX/tarmode.tar" "/smbclient_tar"; then
 		echo "Couldn't create tar file with tarmode -Tc"
 		false
 		return
 	fi
 
-	# Extract data to verify
+	# Extract data to verify - this puts it into $PREFIX/smbclient_tar/
+	# but we must leave it there as it's used to verify in test_tarmode_extraction()
 	if ! tar -xf "$PREFIX/tarmode.tar" -C "$PREFIX"; then
 		echo "Couldn't extract data from created tarfile"
 		false
@@ -119,12 +120,16 @@ test_tarmode_creation() {
 	fi
 
 	# Verify data
-	if ! validate_data "$PREFIX/tarmode" "$LOCAL_PATH"; then
+	if ! validate_data "$PREFIX/smbclient_tar" "$LOCAL_PATH"; then
 		echo "Data not equivalent"
 		false
 		return
 	fi
 
+	# Clear temp data
+	rm -rf -- "$PREFIX"/tarmode > /dev/null 2>&1
+	rm -f "$PREFIX"/tarmode.tar > /dev/null 2>&1
+	$SMBCLIENT //$SERVER/tarmode $CONFIGURATION -U$USERNAME%$PASSWORD -c "deltree smbclient_tar"
 	true
 	return
 
@@ -136,7 +141,7 @@ test_tarmode_extraction() {
 	# Clear temp data
 	rm -rf -- "$PREFIX"/tarmode > /dev/null 2>&1
 	rm -f "$PREFIX"/tarmode.tar > /dev/null 2>&1
-	rm -rf "$LOCAL_PATH" > /dev/null 2>&1
+	$SMBCLIENT //$SERVER/tarmode $CONFIGURATION -U$USERNAME%$PASSWORD -c "deltree smbclient_tar"
 
 	# Build the test data
 	if ! create_test_data "$PREFIX/tarmode"; then
@@ -146,14 +151,14 @@ test_tarmode_extraction() {
 	fi
 
 	# Create tarfile to extract on client
-	if ! tar -cf "$PREFIX/tarmode.tar" -C "$PREFIX" tarmode; then
+	if ! tar -cf "$PREFIX/tarmode.tar" -C "$PREFIX" smbclient_tar; then
 		echo "Couldn't create tar archive"
 		false
 		return
 	fi
 
 	# Extract tarfile with smbclient
-	if ! $SMBCLIENT //$SERVER/tmp $CONFIGURATION -U$USERNAME%$PASSWORD -I $SERVER_IP -p 139 \
+	if ! $SMBCLIENT //$SERVER/tarmode $CONFIGURATION -U$USERNAME%$PASSWORD -I $SERVER_IP -p 139 \
 			$ADDARGS -c "tarmode full" -Tx "$PREFIX/tarmode.tar"; then
 		echo "Couldn't extact tar file with tarmode -Tx"
 		false
@@ -161,12 +166,18 @@ test_tarmode_extraction() {
 	fi
 
 	# Verify data
-	if ! validate_data "$PREFIX/tarmode" "$LOCAL_PATH"; then
+	if ! validate_data "$PREFIX/smbclient_tar" "$LOCAL_PATH"; then
 		echo "Data not equivalent"
 		false
 		return
 	fi
 
+	# Clear temp data
+	rm -rf -- "$PREFIX"/tarmode > /dev/null 2>&1
+	rm -f "$PREFIX"/tarmode.tar > /dev/null 2>&1
+	$SMBCLIENT //$SERVER/tarmode $CONFIGURATION -U$USERNAME%$PASSWORD -c "deltree smbclient_tar"
+	# Cleanup the verification data created by test_tarmode_creation().
+	rm -rf "$PREFIX"/smbclient_tar > /dev/null 2>&1
 	true
 	return
 
diff --git a/source3/selftest/tests.py b/source3/selftest/tests.py
index 349be8cd7da..9b13ceaa4ab 100755
--- a/source3/selftest/tests.py
+++ b/source3/selftest/tests.py
@@ -484,23 +484,23 @@ for env in ["fileserver"]:
     plantestsuite("samba3.blackbox.smbclient_tarmode.NT1", env + "_smb1_done",
                   [os.path.join(samba3srcdir, "script/tests/test_smbclient_tarmode.sh"),
                    '$SERVER', '$SERVER_IP', '$USERNAME', '$PASSWORD',
-                   '$LOCAL_PATH/tarmode', '$PREFIX', smbclient3, configuration, "-mNT1"])
+                   '$LOCAL_PATH/tarmode/smbclient_tar', '$PREFIX', smbclient3, configuration, "-mNT1"])
     plantestsuite("samba3.blackbox.smbclient_tarmode.SMB3", env,
                   [os.path.join(samba3srcdir, "script/tests/test_smbclient_tarmode.sh"),
                    '$SERVER', '$SERVER_IP', '$USERNAME', '$PASSWORD',
-                   '$LOCAL_PATH/tarmode', '$PREFIX', smbclient3, configuration, "-mSMB3"])
+                   '$LOCAL_PATH/tarmode/smbclient_tar', '$PREFIX', smbclient3, configuration, "-mSMB3"])
 
     # Test suite for new smbclient/tar with libarchive (GSoC 13)
     plantestsuite("samba3.blackbox.smbclient_tar.NT1", env + "_smb1_done",
                   [os.path.join(samba3srcdir, "script/tests/test_smbclient_tarmode.pl"),
-                   '-n', '$SERVER', '-i', '$SERVER_IP', '-s', 'tmp',
-                   '-u', '$USERNAME', '-p', '$PASSWORD', '-l', '$LOCAL_PATH/tarmode',
+                   '-n', '$SERVER', '-i', '$SERVER_IP', '-s', 'tarmode2',
+                   '-u', '$USERNAME', '-p', '$PASSWORD', '-l', '$LOCAL_PATH/tarmode2',
                    '-d', '$PREFIX', '-b', smbclient3,
                    '--subunit', '--', configuration, '-mNT1'])
     plantestsuite("samba3.blackbox.smbclient_tar.SMB3", env,
                   [os.path.join(samba3srcdir, "script/tests/test_smbclient_tarmode.pl"),
-                   '-n', '$SERVER', '-i', '$SERVER_IP', '-s', 'tmp',
-                   '-u', '$USERNAME', '-p', '$PASSWORD', '-l', '$LOCAL_PATH/tarmode',
+                   '-n', '$SERVER', '-i', '$SERVER_IP', '-s', 'tarmode2',
+                   '-u', '$USERNAME', '-p', '$PASSWORD', '-l', '$LOCAL_PATH/tarmode2',
                    '-d', '$PREFIX', '-b', smbclient3,
                    '--subunit', '--', configuration, '-mSMB3'])
 


-- 
Samba Shared Repository


From kseeger at samba.org  Wed Dec  2 14:50:03 2020
From: kseeger at samba.org (Karolin Seeger)
Date: Wed,  2 Dec 2020 14:50:03 +0000 (UTC)
Subject: [SCM] Samba Shared Repository - branch v4-13-test updated
Message-ID: <20201202145005.25746140345@sn.samba.org>

The branch, v4-13-test has been updated
       via  585c49f21f7 vfs_glusterfs: print exact cmdline for disabling write-behind translator
       via  587fa331f62 manpages/vfs_glusterfs: Mention silent skipping of write-behind translator
       via  2ea7b5c43e8 selftest: Remove samba3.blackbox.smbclient_tar from flapping tests
       via  8cec2732890 clitar: Use do_list()'s recursion in clitar.c
       via  2954051aa6d s3/script/tests: Ensure all remote test files are removed
       via  5f1772d94a3 s3/script/tests: call smbclient deltree to remove remote files
       via  257ce5ed541 s3/script/tests: Make smb_client 'die' behaviour configurable
       via  a0ab7adfd78 s3/script/tests: Remove make_path (for remote dir)
       via  c19198e8732 selftest: make samba3.blackbox.smbclient_tar runnable (even manually)
       via  53a91d6cdc0 s3/script/tests: Fix samba3.blackbox.smbclient_tarmode cleanup
       via  896d93091ab s3/script: Use smbclient deltree to clean up smbclient_tarmode subdir
       via  5908aebf364 s3/script/tests: Use tarmode share for samba3.blackbox.smbclient_tar*
       via  5143b487532 s3/script/test: Use different testdir for samba3.blackbox.smbclient_tarmode
       via  7fb13330380 selftest: Add a new tarmode shares
       via  d67c3ea864b s3/script/tests: Fix 'Unrecognized option(s) passed to mkpath()' error
       via  e9b2be96ebc Revert "vfs_ceph: drop fdopendir handler"
      from  441bf80265f smbclient: Fix recursive mget

https://git.samba.org/?p=samba.git;a=shortlog;h=v4-13-test


- Log -----------------------------------------------------------------
commit 585c49f21f7db686f479ce02b2ae647a313f1184
Author: G?nther Deschner <gd at samba.org>
Date:   Tue Nov 24 15:38:41 2020 +0100

    vfs_glusterfs: print exact cmdline for disabling write-behind translator
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14486
    
    Guenther
    
    Signed-off-by: Guenther Deschner <gd at samba.org>
    Reviewed-by: Anoop C S <anoopcs at samba.org>
    
    Autobuild-User(master): G?nther Deschner <gd at samba.org>
    Autobuild-Date(master): Fri Nov 27 17:15:07 UTC 2020 on sn-devel-184
    
    (cherry picked from commit 369c1d539837b70e94fe9d533d44860c8a9380a1)
    
    Autobuild-User(v4-13-test): Karolin Seeger <kseeger at samba.org>
    Autobuild-Date(v4-13-test): Wed Dec  2 14:49:18 UTC 2020 on sn-devel-184

commit 587fa331f62f6bd36fdb8688c8d0734d02f07ee8
Author: Anoop C S <anoopcs at samba.org>
Date:   Thu Nov 5 16:12:09 2020 +0530

    manpages/vfs_glusterfs: Mention silent skipping of write-behind translator
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14486
    
    Signed-off-by: Anoop C S <anoopcs at samba.org>
    Reviewed-by: Andrew Bartlett <abartlet at samba.org>
    Reviewed-by: Guenther Deschner <gd at samba.org>
    
    Autobuild-User(master): G??nther Deschner <gd at samba.org>
    Autobuild-Date(master): Mon Nov  9 13:30:06 UTC 2020 on sn-devel-184
    
    (cherry picked from commit be03ce7d8bb213633eedcfc3299b8d9865a3c67f)

commit 2ea7b5c43e814faef44cf76b5ffad93e4a2f4840
Author: Noel Power <noel.power at suse.com>
Date:   Mon Nov 30 09:21:50 2020 +0000

    selftest: Remove samba3.blackbox.smbclient_tar from flapping tests
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14581
    
    Signed-off-by: Noel Power <noel.power at suse.com>
    Reviewed-by: Jeremy Allison <jra at samba.org>
    (cherry picked from commit 89e2d68bb4d93dc391af97f35ff1148aec7930b0)

commit 8cec27328904e47462051878db2de97033ecbd9b
Author: Volker Lendecke <vl at samba.org>
Date:   Tue Dec 1 08:58:14 2020 +0100

    clitar: Use do_list()'s recursion in clitar.c
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14581
    
    Signed-off-by: Volker Lendecke <vl at samba.org>
    Reviewed-by: Aurelien Aptel <aaptel at samba.org>
    Reviewed-by: Noel Power <noel.power at suse.com>
    (cherry picked from commit 20e0ce508844fec2dd0011423b10484dc7ccfdb7)

commit 2954051aa6db3b38d24801fe451019ccec0b5c77
Author: Jeremy Allison <jra at samba.org>
Date:   Mon Nov 30 17:19:29 2020 +0000

    s3/script/tests: Ensure all remote test files are removed
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14581
    
    Signed-off-by: Jeremy Allison <jra at samba.org>
    Reviewed-by: Noel Power <noel.power at suse.com>
    (cherry picked from commit 16ffa17ee28edfc3bc70c66abf41b5518aeab8fe)

commit 5f1772d94a34922a4fc83ff8a036cbb3ce2dcdd5
Author: Noel Power <noel.power at suse.com>
Date:   Mon Nov 30 10:41:57 2020 +0000

    s3/script/tests: call smbclient deltree to remove remote files
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14581
    
    Signed-off-by: Noel Power <noel.power at suse.com>
    Reviewed-by: Jeremy Allison <jra at samba.org>
    (cherry picked from commit 6c7dc4959fd5de4382aee413b4cc711cc6f281f4)

commit 257ce5ed541c0e46bbd565bd8a89d5905287897c
Author: Noel Power <noel.power at suse.com>
Date:   Mon Nov 30 10:18:32 2020 +0000

    s3/script/tests: Make smb_client 'die' behaviour configurable
    
    smb_client behaviour is to die if there is an error. This is
    a little heavy handed and make it impossible for example to
    use smb_client to run a command that might fail (where such
    a failure isn't really an error) E.G. Calling deltree and
    the directory doesn't exist
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14581
    
    Signed-off-by: Noel Power <noel.power at suse.com>
    Reviewed-by: Jeremy Allison <jra at samba.org>
    (cherry picked from commit 363bfa4e1ca10e64057a6d04d6faff7c788db89d)

commit a0ab7adfd788bc8cc58579b94c75386d492c2e02
Author: Noel Power <noel.power at suse.com>
Date:   Mon Nov 30 09:59:58 2020 +0000

    s3/script/tests: Remove make_path (for remote dir)
    
    LOCALPATH is actually the local path to the share, we should
    not need to create the share path (it should already exist)
    
    Note: When we remove the tree located at LOCALPATH we keep the root
          so the share path should always be there
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14581
    
    Signed-off-by: Noel Power <noel.power at suse.com>
    Reviewed-by: Jeremy Allison <jra at samba.org>
    (cherry picked from commit 99ffa4a98287f125e45690e87b32616f4d4254e4)

commit c19198e873224c07a19dfae14d3871c577768344
Author: Noel Power <noel.power at suse.com>
Date:   Mon Nov 30 11:15:06 2020 +0000

    selftest: make samba3.blackbox.smbclient_tar runnable (even manually)
    
    samba3.blackbox.smbclient_tar is marked as flapping so it
    seems we have missed that it has stopped working. The local path
    passed to script/tests/test_smbclient_tarmode.pl must point to a
    valid share
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14581
    
    Signed-off-by: Noel Power <noel.power at suse.com>
    Reviewed-by: Jeremy Allison <jra at samba.org>
    (cherry picked from commit 6f246658cf003f7e2f393f7b7490d9e8ae84e21c)

commit 53a91d6cdc0e726d741ab217522da3f205392090
Author: Noel Power <noel.power at suse.com>
Date:   Mon Nov 30 17:39:25 2020 +0000

    s3/script/tests: Fix samba3.blackbox.smbclient_tarmode cleanup
    
    Make sure samba3.blackbox.smbclient_tarmode removes data files
    not just before running the test but also after
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14581
    
    Signed-off-by: Noel Power <noel.power at suse.com>
    Reviewed-by: Jeremy Allison <jra at samba.org>
    (cherry picked from commit 4bb3bffa4b7a770d36138c45f717a9048ef82cff)

commit 896d93091abe6b667c52e87273f22a91d9175eb0
Author: Noel Power <noel.power at suse.com>
Date:   Fri Nov 27 15:52:27 2020 +0000

    s3/script: Use smbclient deltree to clean up smbclient_tarmode subdir
    
    Replace rm -rf of local dir (that is hosted remotely)
    with smbclient deltree
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14581
    
    Signed-off-by: Noel Power <noel.power at suse.com>
    Reviewed-by: Jeremy Allison <jra at samba.org>
    (cherry picked from commit fec1f8faffd9eb1aae77e7c515e57897be34a255)

commit 5908aebf364802e7315aad8f116ad431544ac29d
Author: Noel Power <noel.power at suse.com>
Date:   Fri Nov 27 15:33:26 2020 +0000

    s3/script/tests: Use tarmode share for samba3.blackbox.smbclient_tar*
    
    After this change both samba3.blackbox.smbclient_tar &
    samba3.blackbox.smbclient_tarmode now use the same dedicated share
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14581
    
    Signed-off-by: Noel Power <noel.power at suse.com>
    Reviewed-by: Jeremy Allison <jra at samba.org>
    (cherry picked from commit be8dca68f89f110ef5947e0c2a7258554772cf9a)

commit 5143b4875328196ed2766ba077055ce50704b5e2
Author: Noel Power <noel.power at suse.com>
Date:   Fri Nov 27 15:25:21 2020 +0000

    s3/script/test: Use different testdir for samba3.blackbox.smbclient_tarmode
    
    The other tarmode torture test samba3.blackbox.smbclient_tar now uses a share
    'tarmode' which uses the same source path as samba3.blackbox.smbclient_tarmode
    
    Avoid conflicting paths and use a new subdir (of the test share) called
    'smbclient_tarmode'
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14581
    
    Signed-off-by: Noel Power <noel.power at suse.com>
    Reviewed-by: Jeremy Allison <jra at samba.org>
    (cherry picked from commit 6cb0a00f4ab4bc1a8193d50cc076ec7174a5ece9)

commit 7fb1333038085529334e8e3109e5eda6b5df14ae
Author: Noel Power <noel.power at suse.com>
Date:   Thu Nov 26 17:31:50 2020 +0000

    selftest: Add a new tarmode shares
    
    samba3.blackbox.smbclient_tar & samba3.blackbox.smbclient_tar
    need separate shares with own xattr tdb(s)
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14581
    
    Signed-off-by: Noel Power <noel.power at suse.com>
    Reviewed-by: Jeremy Allison <jra at samba.org>
    (cherry picked from commit a250f73366983d2a7397608a611f295f10dbb548)

commit d67c3ea864b26e440f15162e429dec199e7304e8
Author: Noel Power <noel.power at suse.com>
Date:   Fri Nov 27 12:01:49 2020 +0000

    s3/script/tests: Fix 'Unrecognized option(s) passed to mkpath()' error
    
    'keep_root' is an unrecognised option for make_path/mkpath
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14581
    
    Signed-off-by: Noel Power <noel.power at suse.com>
    Reviewed-by: Jeremy Allison <jra at samba.org>
    (cherry picked from commit 4f5a7f11b7732c3efb511e68f6b9d434d59bb3e8)

commit e9b2be96ebcc2dc8da8174f3333a744eff06f716
Author: David Disseldorp <ddiss at samba.org>
Date:   Mon Oct 5 12:28:27 2020 +0200

    Revert "vfs_ceph: drop fdopendir handler"
    
    This reverts commit 76d7d05b1da6c0703b1c2bade0c4467c7cc1adec.
    OpenDir_fsp() no longer falls back to regular open, so this hook is
    required.
    
    Bug: https://bugzilla.samba.org/show_bug.cgi?id=14519
    
    Signed-off-by: David Disseldorp <ddiss at samba.org>
    Reviewed-by: Samuel Cabrero <scabrero at samba.org>
    
    Autobuild-User(master): David Disseldorp <ddiss at samba.org>
    Autobuild-Date(master): Mon Oct  5 12:38:34 UTC 2020 on sn-devel-184
    
    (cherry picked from commit 83ab59d929a6319c18341cb69d5084b563fb59bb)

-----------------------------------------------------------------------

Summary of changes:
 docs-xml/manpages/vfs_glusterfs.8.xml          |  9 ++++
 selftest/flapping                              |  1 -
 selftest/target/Samba3.pm                      | 11 +++++
 source3/client/clitar.c                        | 41 ++++-------------
 source3/modules/vfs_ceph.c                     | 15 +++++--
 source3/modules/vfs_glusterfs.c                |  7 ++-
 source3/script/tests/test_smbclient_tarmode.pl | 62 ++++++++++++++++++++++----
 source3/script/tests/test_smbclient_tarmode.sh | 29 ++++++++----
 source3/selftest/tests.py                      | 12 ++---
 9 files changed, 124 insertions(+), 63 deletions(-)


Changeset truncated at 500 lines:

diff --git a/docs-xml/manpages/vfs_glusterfs.8.xml b/docs-xml/manpages/vfs_glusterfs.8.xml
index 7a4da1af919..d25135e14ac 100644
--- a/docs-xml/manpages/vfs_glusterfs.8.xml
+++ b/docs-xml/manpages/vfs_glusterfs.8.xml
@@ -179,7 +179,16 @@
                 translator and refuse to connect if detected.
                 Please disable the write-behind translator for the GlusterFS
                 volume to allow the plugin to connect to the volume.
+                The write-behind translator can easily be disabled via calling
+                <programlisting>
+                        gluster volume set &lt;volumename&gt; performance.write-behind off
+                </programlisting> on the commandline.
 	</para>
+        <para>
+                With GlusterFS versions >= 9, we silently bypass write-behind
+                translator during initial connect and failure is avoided.
+        </para>
+
 </refsect1>
 
 
diff --git a/selftest/flapping b/selftest/flapping
index c9f0adbf1bd..8c3f9e8969a 100644
--- a/selftest/flapping
+++ b/selftest/flapping
@@ -31,6 +31,5 @@
 # This test just is not reliable in finding the max search limit
 #
 ^samba4.ldap.notification.python\(.*\).__main__.LDAPNotificationTest.test_max_search
-^samba3.blackbox.smbclient_tar.* # fails very, very often on sn-devel
 ^samba3.blackbox.smbclient_s3.*.sending a message to the remote server # flakey on sn-devel-104 and sn-devel-144
 ^samba3.blackbox.smbclient_s3.*.creating a good symlink and deleting it by path # flakey on sn-devel-104 and sn-devel-144
diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm
index 0a8cefa811d..e141f102ef1 100755
--- a/selftest/target/Samba3.pm
+++ b/selftest/target/Samba3.pm
@@ -1334,6 +1334,9 @@ sub setup_fileserver
 	my $tarmode_sharedir="$share_dir/tarmode";
 	push(@dirs,$tarmode_sharedir);
 
+	my $tarmode2_sharedir="$share_dir/tarmode2";
+	push(@dirs,$tarmode2_sharedir);
+
 	my $smbcacls_sharedir="$share_dir/smbcacls";
 	push(@dirs,$smbcacls_sharedir);
 
@@ -1362,6 +1365,14 @@ sub setup_fileserver
 
 	get quota command = $prefix_abs/getset_quota.py
 	set quota command = $prefix_abs/getset_quota.py
+[tarmode]
+	path = $tarmode_sharedir
+	comment = tar test share
+	xattr_tdb:file = $prefix_abs/tarmode-xattr.tdb
+[tarmode2]
+	path = $tarmode2_sharedir
+	comment = tar test share
+	xattr_tdb:file = $prefix_abs/tarmode2-xattr.tdb
 [spotlight]
 	path = $share_dir
 	spotlight = yes
diff --git a/source3/client/clitar.c b/source3/client/clitar.c
index 3fe3622aba6..4fd1f3c47d9 100644
--- a/source3/client/clitar.c
+++ b/source3/client/clitar.c
@@ -711,7 +711,7 @@ static int tar_create(struct tar* t)
 			goto out_close;
 		}
 		DBG(5, ("tar_process do_list with mask: %s\n", mask));
-		status = do_list(mask, TAR_DO_LIST_ATTR, get_file_callback, false, true);
+		status = do_list(mask, TAR_DO_LIST_ATTR, get_file_callback, true, true);
 		if (!NT_STATUS_IS_OK(status)) {
 			DBG(0, ("do_list fail %s\n", nt_errstr(status)));
 			err = 1;
@@ -806,7 +806,7 @@ static int tar_create_from_list(struct tar *t)
 			DBG(5, ("cd '%s' before do_list\n", base));
 			client_set_cur_dir(base);
 		}
-		status = do_list(mask, TAR_DO_LIST_ATTR, get_file_callback, false, true);
+		status = do_list(mask, TAR_DO_LIST_ATTR, get_file_callback, true, true);
 		if (base != NULL) {
 			client_set_cur_dir(start_dir);
 		}
@@ -837,7 +837,7 @@ static NTSTATUS get_file_callback(struct cli_state *cli,
 	char *remote_name;
 	char *old_dir = NULL;
 	char *new_dir = NULL;
-	const char *initial_dir = client_get_cur_dir();
+	const char *initial_dir = dir;
 	bool skip = false;
 	bool isdir;
 	int rc;
@@ -846,7 +846,7 @@ static NTSTATUS get_file_callback(struct cli_state *cli,
 		return NT_STATUS_NO_MEMORY;
 	}
 
-	remote_name = talloc_asprintf(ctx, "%s%s", initial_dir, finfo->name);
+	remote_name = talloc_asprintf(ctx, "%s\\%s", initial_dir, finfo->name);
 	if (remote_name == NULL) {
 		status = NT_STATUS_NO_MEMORY;
 		goto out;
@@ -884,35 +884,10 @@ static NTSTATUS get_file_callback(struct cli_state *cli,
 		goto out;
 	}
 
-	if (isdir) {
-		char *mask;
-		mask = talloc_asprintf(ctx, "%s*", new_dir);
-		if (mask == NULL) {
-			status = NT_STATUS_NO_MEMORY;
-			goto out;
-		}
-		mask = client_clean_name(ctx, mask);
-		if (mask == NULL) {
-			status = NT_STATUS_NO_MEMORY;
-			goto out;
-		}
-
-		rc = tar_get_file(&tar_ctx, remote_name, finfo);
-		if (rc != 0) {
-			status = NT_STATUS_UNSUCCESSFUL;
-			goto out;
-		}
-
-		client_set_cur_dir(new_dir);
-		do_list(mask, TAR_DO_LIST_ATTR, get_file_callback, false, true);
-		client_set_cur_dir(old_dir);
-		tar_ctx.numdir++;
-	} else {
-		rc = tar_get_file(&tar_ctx, remote_name, finfo);
-		if (rc != 0) {
-			status = NT_STATUS_UNSUCCESSFUL;
-			goto out;
-		}
+	rc = tar_get_file(&tar_ctx, remote_name, finfo);
+	if (rc != 0) {
+		status = NT_STATUS_UNSUCCESSFUL;
+		goto out;
 	}
 
 out:
diff --git a/source3/modules/vfs_ceph.c b/source3/modules/vfs_ceph.c
index 0378d633782..a87d162e573 100644
--- a/source3/modules/vfs_ceph.c
+++ b/source3/modules/vfs_ceph.c
@@ -306,9 +306,18 @@ static DIR *cephwrap_fdopendir(struct vfs_handle_struct *handle,
 			       const char *mask,
 			       uint32_t attributes)
 {
-	/* OpenDir_fsp() falls back to regular open */
-	errno = ENOSYS;
-	return NULL;
+	int ret = 0;
+	struct ceph_dir_result *result;
+	DBG_DEBUG("[CEPH] fdopendir(%p, %p)\n", handle, fsp);
+
+	ret = ceph_opendir(handle->data, fsp->fsp_name->base_name, &result);
+	if (ret < 0) {
+		result = NULL;
+		errno = -ret; /* We return result which is NULL in this case */
+	}
+
+	DBG_DEBUG("[CEPH] fdopendir(...) = %d\n", ret);
+	return (DIR *) result;
 }
 
 static struct dirent *cephwrap_readdir(struct vfs_handle_struct *handle,
diff --git a/source3/modules/vfs_glusterfs.c b/source3/modules/vfs_glusterfs.c
index 17e945f7e78..10af7e131b2 100644
--- a/source3/modules/vfs_glusterfs.c
+++ b/source3/modules/vfs_glusterfs.c
@@ -345,9 +345,12 @@ static int check_for_write_behind_translator(TALLOC_CTX *mem_ctx,
 	if (write_behind_present) {
 		DBG_ERR("Write behind translator is enabled for "
 			"volume (%s), refusing to connect! "
-			"Please check the vfs_glusterfs(8) manpage for "
+			"Please turn off the write behind translator by calling "
+			"'gluster volume set %s performance.write-behind off' "
+			"on the commandline. "
+			"Check the vfs_glusterfs(8) manpage for "
 			"further details.\n",
-			volume);
+			volume, volume);
 		return -1;
 	}
 
diff --git a/source3/script/tests/test_smbclient_tarmode.pl b/source3/script/tests/test_smbclient_tarmode.pl
index 877eec45cc8..bdbbd1a44a8 100755
--- a/source3/script/tests/test_smbclient_tarmode.pl
+++ b/source3/script/tests/test_smbclient_tarmode.pl
@@ -1,5 +1,4 @@
 #!/usr/bin/perl
-
 # Unix SMB/CIFS implementation.
 # Test suite for the tar backup mode of smbclient.
 # Copyright (C) Aur?lien Aptel 2013
@@ -304,6 +303,8 @@ sub test_creation_attr {
     @inc = grep { $_->attr('a') && !$_->attr_any('h', 's') } @all;
     smb_tar('tarmode inc nohidden nosystem', '-Tc', $TAR, $DIR);
     $err += check_tar($TAR, \@inc);
+    # adjust attr so remote files can be deleted with deltree
+    File::walk(sub { $_->set_attr(qw/n r s h/) }, File::tree($DIR));
 
     $err;
 }
@@ -399,7 +400,10 @@ sub test_creation_incremental {
     } else {
         smb_tar('', '-Tcg', $TAR, $DIR);
     }
-    return check_tar($TAR, \@files);
+    my $res = check_tar($TAR, \@files);
+    # adjust attr so remote files can be deleted with deltree
+    File::walk(sub { $_->set_attr(qw/n r s h/) }, File::tree($DIR));
+    return $res
 }
 
 
@@ -917,8 +921,22 @@ Remove all files in the server C<$DIR> (not root)
 sub reset_remote {
     # remove_tree($LOCALPATH . '/'. $DIR);
     # make_path($LOCALPATH . '/'. $DIR);
-    remove_tree($LOCALPATH, {keep_root => 1});
-    make_path($LOCALPATH, {keep_root => 1});
+    my $DIR;
+    my @names;
+    my $name;
+
+    smb_client_cmd(0, '-c', "deltree ./*");
+
+    # Ensure all files are gone.
+
+    opendir(DIR,$LOCALPATH) or die "Can't open $LOCALPATH\n";
+    @names = readdir(DIR) or die "Unable to read $LOCALPATH\n";
+    closedir(DIR);
+    foreach $name (@names) {
+	next if ($name eq ".");   # skip the current directory entry
+	next if ($name eq "..");  # skip the parent  directory entry
+	die "$LOCALPATH not empty\n";
+    }
 }
 
 =head3 C<reset_tmp( )>
@@ -1120,7 +1138,9 @@ sub check_tar {
     return (@more + @less + @diff); # nb of errors
 }
 
-=head3 C<smb_client ( @args )>
+=head3 C<smb_client_cmd( $will_die, @args)>
+
+=head3 C<smb_client_cmd( 0, '-c', 'deltree', $somedir )>
 
 Run smbclient with C<@args> passed as argument and return output.
 
@@ -1131,11 +1151,12 @@ the command-line are already inserted.
 
 The output contains both the C<STDOUT> and C<STDERR>.
 
-Die if smbclient crashes or exits with an error code.
+if C<$will_die> then Die if smbclient crashes or exits with an error code.
+otherwise return output
 
 =cut
-sub smb_client {
-    my (@args) = @_;
+sub smb_client_cmd {
+    my ($will_die, @args) = @_;
 
     my $fullpath = "//$HOST/$SHARE";
     my $cmd = sprintf("%s %s %s",
@@ -1168,11 +1189,34 @@ sub smb_client {
     }
 
     if ($err) {
-        die "ERROR: $errstr";
+	if ($will_die) {
+		die "ERROR: $errstr";
+	} else {
+		say "ERROR: $errstr";
+	}
     }
     return $out;
 }
 
+=head3 C<smb_client ( @args )>
+
+Run smbclient with C<@args> passed as argument and return output.
+
+Each element of C<@args> becomes one escaped argument of smbclient.
+
+Host, share, user, password and the additionnal arguments provided on
+the command-line are already inserted.
+
+The output contains both the C<STDOUT> and C<STDERR>.
+
+Die if smbclient crashes or exits with an error code.
+
+=cut
+sub smb_client {
+    my (@args) = @_;
+    return smb_client_cmd(1, @args)
+}
+
 sub smb_cmd {
     return smb_client('-c', join(' ', @_));
 }
diff --git a/source3/script/tests/test_smbclient_tarmode.sh b/source3/script/tests/test_smbclient_tarmode.sh
index 3779c38a5ca..8bc5b9947cf 100755
--- a/source3/script/tests/test_smbclient_tarmode.sh
+++ b/source3/script/tests/test_smbclient_tarmode.sh
@@ -94,7 +94,7 @@ test_tarmode_creation() {
 	# Clear temp data
 	rm -rf -- "$PREFIX"/tarmode > /dev/null 2>&1
 	rm -f "$PREFIX"/tarmode.tar > /dev/null 2>&1
-	rm -rf "$LOCAL_PATH" > /dev/null 2>&1
+	$SMBCLIENT //$SERVER/tarmode $CONFIGURATION -U$USERNAME%$PASSWORD -c "deltree smbclient_tar"
 
 	# Build the test data
 	if ! create_test_data "$LOCAL_PATH"; then
@@ -104,14 +104,15 @@ test_tarmode_creation() {
 	fi
 
 	# Create tarfile with smbclient
-	if ! $SMBCLIENT //$SERVER/tmp $CONFIGURATION -U$USERNAME%$PASSWORD -I $SERVER_IP -p 139 \
-			$ADDARGS -c "tarmode full" -Tc "$PREFIX/tarmode.tar" "/tarmode"; then
+	if ! $SMBCLIENT //$SERVER/tarmode $CONFIGURATION -U$USERNAME%$PASSWORD -I $SERVER_IP -p 139 \
+			$ADDARGS -c "tarmode full" -Tc "$PREFIX/tarmode.tar" "/smbclient_tar"; then
 		echo "Couldn't create tar file with tarmode -Tc"
 		false
 		return
 	fi
 
-	# Extract data to verify
+	# Extract data to verify - this puts it into $PREFIX/smbclient_tar/
+	# but we must leave it there as it's used to verify in test_tarmode_extraction()
 	if ! tar -xf "$PREFIX/tarmode.tar" -C "$PREFIX"; then
 		echo "Couldn't extract data from created tarfile"
 		false
@@ -119,12 +120,16 @@ test_tarmode_creation() {
 	fi
 
 	# Verify data
-	if ! validate_data "$PREFIX/tarmode" "$LOCAL_PATH"; then
+	if ! validate_data "$PREFIX/smbclient_tar" "$LOCAL_PATH"; then
 		echo "Data not equivalent"
 		false
 		return
 	fi
 
+	# Clear temp data
+	rm -rf -- "$PREFIX"/tarmode > /dev/null 2>&1
+	rm -f "$PREFIX"/tarmode.tar > /dev/null 2>&1
+	$SMBCLIENT //$SERVER/tarmode $CONFIGURATION -U$USERNAME%$PASSWORD -c "deltree smbclient_tar"
 	true
 	return
 
@@ -136,7 +141,7 @@ test_tarmode_extraction() {
 	# Clear temp data
 	rm -rf -- "$PREFIX"/tarmode > /dev/null 2>&1
 	rm -f "$PREFIX"/tarmode.tar > /dev/null 2>&1
-	rm -rf "$LOCAL_PATH" > /dev/null 2>&1
+	$SMBCLIENT //$SERVER/tarmode $CONFIGURATION -U$USERNAME%$PASSWORD -c "deltree smbclient_tar"
 
 	# Build the test data
 	if ! create_test_data "$PREFIX/tarmode"; then
@@ -146,14 +151,14 @@ test_tarmode_extraction() {
 	fi
 
 	# Create tarfile to extract on client
-	if ! tar -cf "$PREFIX/tarmode.tar" -C "$PREFIX" tarmode; then
+	if ! tar -cf "$PREFIX/tarmode.tar" -C "$PREFIX" smbclient_tar; then
 		echo "Couldn't create tar archive"
 		false
 		return
 	fi
 
 	# Extract tarfile with smbclient
-	if ! $SMBCLIENT //$SERVER/tmp $CONFIGURATION -U$USERNAME%$PASSWORD -I $SERVER_IP -p 139 \
+	if ! $SMBCLIENT //$SERVER/tarmode $CONFIGURATION -U$USERNAME%$PASSWORD -I $SERVER_IP -p 139 \
 			$ADDARGS -c "tarmode full" -Tx "$PREFIX/tarmode.tar"; then
 		echo "Couldn't extact tar file with tarmode -Tx"
 		false
@@ -161,12 +166,18 @@ test_tarmode_extraction() {
 	fi
 
 	# Verify data
-	if ! validate_data "$PREFIX/tarmode" "$LOCAL_PATH"; then
+	if ! validate_data "$PREFIX/smbclient_tar" "$LOCAL_PATH"; then
 		echo "Data not equivalent"
 		false
 		return
 	fi
 
+	# Clear temp data
+	rm -rf -- "$PREFIX"/tarmode > /dev/null 2>&1
+	rm -f "$PREFIX"/tarmode.tar > /dev/null 2>&1
+	$SMBCLIENT //$SERVER/tarmode $CONFIGURATION -U$USERNAME%$PASSWORD -c "deltree smbclient_tar"
+	# Cleanup the verification data created by test_tarmode_creation().
+	rm -rf "$PREFIX"/smbclient_tar > /dev/null 2>&1
 	true
 	return
 
diff --git a/source3/selftest/tests.py b/source3/selftest/tests.py
index f9202f3f93a..27dc7587b17 100755
--- a/source3/selftest/tests.py
+++ b/source3/selftest/tests.py
@@ -476,23 +476,23 @@ for env in ["fileserver"]:
     plantestsuite("samba3.blackbox.smbclient_tarmode.NT1", env + "_smb1_done",
                   [os.path.join(samba3srcdir, "script/tests/test_smbclient_tarmode.sh"),
                    '$SERVER', '$SERVER_IP', '$USERNAME', '$PASSWORD',
-                   '$LOCAL_PATH/tarmode', '$PREFIX', smbclient3, configuration, "-mNT1"])
+                   '$LOCAL_PATH/tarmode/smbclient_tar', '$PREFIX', smbclient3, configuration, "-mNT1"])
     plantestsuite("samba3.blackbox.smbclient_tarmode.SMB3", env,
                   [os.path.join(samba3srcdir, "script/tests/test_smbclient_tarmode.sh"),
                    '$SERVER', '$SERVER_IP', '$USERNAME', '$PASSWORD',
-                   '$LOCAL_PATH/tarmode', '$PREFIX', smbclient3, configuration, "-mSMB3"])
+                   '$LOCAL_PATH/tarmode/smbclient_tar', '$PREFIX', smbclient3, configuration, "-mSMB3"])
 
     # Test suite for new smbclient/tar with libarchive (GSoC 13)
     plantestsuite("samba3.blackbox.smbclient_tar.NT1", env + "_smb1_done",
                   [os.path.join(samba3srcdir, "script/tests/test_smbclient_tarmode.pl"),
-                   '-n', '$SERVER', '-i', '$SERVER_IP', '-s', 'tmp',
-                   '-u', '$USERNAME', '-p', '$PASSWORD', '-l', '$LOCAL_PATH/tarmode',
+                   '-n', '$SERVER', '-i', '$SERVER_IP', '-s', 'tarmode2',
+                   '-u', '$USERNAME', '-p', '$PASSWORD', '-l', '$LOCAL_PATH/tarmode2',
                    '-d', '$PREFIX', '-b', smbclient3,
                    '--subunit', '--', configuration, '-mNT1'])
     plantestsuite("samba3.blackbox.smbclient_tar.SMB3", env,
                   [os.path.join(samba3srcdir, "script/tests/test_smbclient_tarmode.pl"),
-                   '-n', '$SERVER', '-i', '$SERVER_IP', '-s', 'tmp',
-                   '-u', '$USERNAME', '-p', '$PASSWORD', '-l', '$LOCAL_PATH/tarmode',
+                   '-n', '$SERVER', '-i', '$SERVER_IP', '-s', 'tarmode2',
+                   '-u', '$USERNAME', '-p', '$PASSWORD', '-l', '$LOCAL_PATH/tarmode2',
                    '-d', '$PREFIX', '-b', smbclient3,
                    '--subunit', '--', configuration, '-mSMB3'])
 


-- 
Samba Shared Repository


From kseeger at samba.org  Wed Dec  2 16:05:02 2020
From: kseeger at samba.org (Karolin Seeger)
Date: Wed,  2 Dec 2020 16:05:02 +0000 (UTC)
Subject: [SCM] Samba Shared Repository - branch v4-11-test updated
Message-ID: <20201202160502.E68DD140345@sn.samba.org>

The branch, v4-11-test has been updated
       via  f1b1dc12aba vfs_glusterfs: print exact cmdline for disabling write-behind translator
       via  eb525a3e070 manpages/vfs_glusterfs: Mention silent skipping of write-behind translator
       via  d6fb44cba25 s3-vfs_glusterfs: always disable write-behind translator
      from  49710332b59 s3: modules: gluster. Fix the error I made in preventing talloc leaks from a function.

https://git.samba.org/?p=samba.git;a=shortlog;h=v4-11-test


- Log -----------------------------------------------------------------
commit f1b1dc12abaecbdef68f752d9a424180b0e6890d
Author: G?nther Deschner <gd at samba.org>
Date:   Tue Nov 24 15:38:41 2020 +0100

    vfs_glusterfs: print exact cmdline for disabling write-behind translator
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14486
    
    Guenther
    
    Signed-off-by: Guenther Deschner <gd at samba.org>
    Reviewed-by: Anoop C S <anoopcs at samba.org>
    
    Autobuild-User(master): G?nther Deschner <gd at samba.org>
    Autobuild-Date(master): Fri Nov 27 17:15:07 UTC 2020 on sn-devel-184
    
    (cherry picked from commit 369c1d539837b70e94fe9d533d44860c8a9380a1)
    
    Autobuild-User(v4-11-test): Karolin Seeger <kseeger at samba.org>
    Autobuild-Date(v4-11-test): Wed Dec  2 16:04:24 UTC 2020 on sn-devel-184

commit eb525a3e0704595550a130ae865304a90f22b0f8
Author: Anoop C S <anoopcs at samba.org>
Date:   Thu Nov 5 16:12:09 2020 +0530

    manpages/vfs_glusterfs: Mention silent skipping of write-behind translator
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14486
    
    Signed-off-by: Anoop C S <anoopcs at samba.org>
    Reviewed-by: Andrew Bartlett <abartlet at samba.org>
    Reviewed-by: Guenther Deschner <gd at samba.org>
    
    Autobuild-User(master): G??nther Deschner <gd at samba.org>
    Autobuild-Date(master): Mon Nov  9 13:30:06 UTC 2020 on sn-devel-184
    
    (cherry picked from commit be03ce7d8bb213633eedcfc3299b8d9865a3c67f)

commit d6fb44cba256ce98feea3dc968653ca22aa715bd
Author: G?nther Deschner <gd at samba.org>
Date:   Mon Nov 2 16:10:44 2020 +0100

    s3-vfs_glusterfs: always disable write-behind translator
    
    The "pass-through" option has now been merged upstream as of:
    https://github.com/gluster/glusterfs/pull/1640
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14486
    
    Guenther
    
    Signed-off-by: Guenther Deschner <gd at samba.org>
    Pair-Programmed-With: Anoop C S <anoopcs at samba.org>
    Pair-Programmed-With: Sachin Prabhu <sprabhu at redhat.com>
    Reviewed-by: Jeremy Allison <jra at samba.org>
    
    Autobuild-User(master): Jeremy Allison <jra at samba.org>
    Autobuild-Date(master): Wed Nov  4 22:53:49 UTC 2020 on sn-devel-184
    
    (cherry picked from commit a51cda69ec6a017ad04b5690a3ae67a5478deee9)
    
    Autobuild-User(v4-13-test): Karolin Seeger <kseeger at samba.org>
    Autobuild-Date(v4-13-test): Thu Nov  5 13:54:25 UTC 2020 on sn-devel-184

-----------------------------------------------------------------------

Summary of changes:
 docs-xml/manpages/vfs_glusterfs.8.xml |  9 +++++++++
 source3/modules/vfs_glusterfs.c       | 27 ++++++++++++++++++++++-----
 source3/wscript                       |  3 +++
 3 files changed, 34 insertions(+), 5 deletions(-)


Changeset truncated at 500 lines:

diff --git a/docs-xml/manpages/vfs_glusterfs.8.xml b/docs-xml/manpages/vfs_glusterfs.8.xml
index 7a4da1af919..d25135e14ac 100644
--- a/docs-xml/manpages/vfs_glusterfs.8.xml
+++ b/docs-xml/manpages/vfs_glusterfs.8.xml
@@ -179,7 +179,16 @@
                 translator and refuse to connect if detected.
                 Please disable the write-behind translator for the GlusterFS
                 volume to allow the plugin to connect to the volume.
+                The write-behind translator can easily be disabled via calling
+                <programlisting>
+                        gluster volume set &lt;volumename&gt; performance.write-behind off
+                </programlisting> on the commandline.
 	</para>
+        <para>
+                With GlusterFS versions >= 9, we silently bypass write-behind
+                translator during initial connect and failure is avoided.
+        </para>
+
 </refsect1>
 
 
diff --git a/source3/modules/vfs_glusterfs.c b/source3/modules/vfs_glusterfs.c
index 190235cf8ae..ce31b5eba14 100644
--- a/source3/modules/vfs_glusterfs.c
+++ b/source3/modules/vfs_glusterfs.c
@@ -345,9 +345,12 @@ static int check_for_write_behind_translator(TALLOC_CTX *mem_ctx,
 	if (write_behind_present) {
 		DBG_ERR("Write behind translator is enabled for "
 			"volume (%s), refusing to connect! "
-			"Please check the vfs_glusterfs(8) manpage for "
+			"Please turn off the write behind translator by calling "
+			"'gluster volume set %s performance.write-behind off' "
+			"on the commandline. "
+			"Check the vfs_glusterfs(8) manpage for "
 			"further details.\n",
-			volume);
+			volume, volume);
 		return -1;
 	}
 
@@ -365,6 +368,7 @@ static int vfs_gluster_connect(struct vfs_handle_struct *handle,
 	glfs_t *fs = NULL;
 	TALLOC_CTX *tmp_ctx;
 	int ret = 0;
+	bool write_behind_pass_through_set = false;
 
 	tmp_ctx = talloc_new(NULL);
 	if (tmp_ctx == NULL) {
@@ -424,6 +428,17 @@ static int vfs_gluster_connect(struct vfs_handle_struct *handle,
 		goto done;
 	}
 
+#ifdef HAVE_GFAPI_VER_7_9
+	ret = glfs_set_xlator_option(fs, "*-write-behind", "pass-through",
+				     "true");
+	if (ret < 0) {
+		DBG_ERR("%s: Failed to set xlator option: pass-through\n",
+			volume);
+		goto done;
+	}
+	write_behind_pass_through_set = true;
+#endif
+
 	ret = glfs_set_logging(fs, logfile, loglevel);
 	if (ret < 0) {
 		DEBUG(0, ("%s: Failed to set logfile %s loglevel %d\n",
@@ -438,9 +453,11 @@ static int vfs_gluster_connect(struct vfs_handle_struct *handle,
 		goto done;
 	}
 
-	ret = check_for_write_behind_translator(tmp_ctx, fs, volume);
-	if (ret < 0) {
-		goto done;
+	if (!write_behind_pass_through_set) {
+		ret = check_for_write_behind_translator(tmp_ctx, fs, volume);
+		if (ret < 0) {
+			goto done;
+		}
 	}
 
 	ret = glfs_set_preopened(volume, handle->conn->connectpath, fs);
diff --git a/source3/wscript b/source3/wscript
index 7b257bcb845..47f97c60321 100644
--- a/source3/wscript
+++ b/source3/wscript
@@ -1591,6 +1591,9 @@ main() {
         conf.CHECK_CFG(package='glusterfs-api', args='"glusterfs-api >= 7.6" --cflags --libs',
                        msg='Checking for glusterfs-api >= 7.6',
                        uselib_store="GFAPI_VER_7_6")
+        conf.CHECK_CFG(package='glusterfs-api', args='"glusterfs-api >= 7.9" --cflags --libs',
+                       msg='Checking for glusterfs-api >= 7.9',
+                       uselib_store="GFAPI_VER_7_9")
     else:
         conf.SET_TARGET_TYPE('gfapi', 'EMPTY')
         conf.undefine('HAVE_GLUSTERFS')


-- 
Samba Shared Repository


From kseeger at samba.org  Wed Dec  2 17:36:02 2020
From: kseeger at samba.org (Karolin Seeger)
Date: Wed,  2 Dec 2020 17:36:02 +0000 (UTC)
Subject: [SCM] Samba Shared Repository - branch v4-12-test updated
Message-ID: <20201202173602.BCB01140299@sn.samba.org>

The branch, v4-12-test has been updated
       via  ecdddde3c53 vfs_glusterfs: print exact cmdline for disabling write-behind translator
       via  9bcd19c42ae manpages/vfs_glusterfs: Mention silent skipping of write-behind translator
      from  b3665f70109 vfs_shadow_copy2: Preserve all open flags assuming ROFS

https://git.samba.org/?p=samba.git;a=shortlog;h=v4-12-test


- Log -----------------------------------------------------------------
commit ecdddde3c5387ec3749d9758a7191b9ff9bc91d8
Author: G?nther Deschner <gd at samba.org>
Date:   Tue Nov 24 15:38:41 2020 +0100

    vfs_glusterfs: print exact cmdline for disabling write-behind translator
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14486
    
    Guenther
    
    Signed-off-by: Guenther Deschner <gd at samba.org>
    Reviewed-by: Anoop C S <anoopcs at samba.org>
    
    Autobuild-User(master): G?nther Deschner <gd at samba.org>
    Autobuild-Date(master): Fri Nov 27 17:15:07 UTC 2020 on sn-devel-184
    
    (cherry picked from commit 369c1d539837b70e94fe9d533d44860c8a9380a1)
    
    Autobuild-User(v4-12-test): Karolin Seeger <kseeger at samba.org>
    Autobuild-Date(v4-12-test): Wed Dec  2 17:35:21 UTC 2020 on sn-devel-184

commit 9bcd19c42aee884f79f19128bbf0293ad0da1fb6
Author: Anoop C S <anoopcs at samba.org>
Date:   Thu Nov 5 16:12:09 2020 +0530

    manpages/vfs_glusterfs: Mention silent skipping of write-behind translator
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14486
    
    Signed-off-by: Anoop C S <anoopcs at samba.org>
    Reviewed-by: Andrew Bartlett <abartlet at samba.org>
    Reviewed-by: Guenther Deschner <gd at samba.org>
    
    Autobuild-User(master): G??nther Deschner <gd at samba.org>
    Autobuild-Date(master): Mon Nov  9 13:30:06 UTC 2020 on sn-devel-184
    
    (cherry picked from commit be03ce7d8bb213633eedcfc3299b8d9865a3c67f)

-----------------------------------------------------------------------

Summary of changes:
 docs-xml/manpages/vfs_glusterfs.8.xml | 9 +++++++++
 source3/modules/vfs_glusterfs.c       | 7 +++++--
 2 files changed, 14 insertions(+), 2 deletions(-)


Changeset truncated at 500 lines:

diff --git a/docs-xml/manpages/vfs_glusterfs.8.xml b/docs-xml/manpages/vfs_glusterfs.8.xml
index 7a4da1af919..d25135e14ac 100644
--- a/docs-xml/manpages/vfs_glusterfs.8.xml
+++ b/docs-xml/manpages/vfs_glusterfs.8.xml
@@ -179,7 +179,16 @@
                 translator and refuse to connect if detected.
                 Please disable the write-behind translator for the GlusterFS
                 volume to allow the plugin to connect to the volume.
+                The write-behind translator can easily be disabled via calling
+                <programlisting>
+                        gluster volume set &lt;volumename&gt; performance.write-behind off
+                </programlisting> on the commandline.
 	</para>
+        <para>
+                With GlusterFS versions >= 9, we silently bypass write-behind
+                translator during initial connect and failure is avoided.
+        </para>
+
 </refsect1>
 
 
diff --git a/source3/modules/vfs_glusterfs.c b/source3/modules/vfs_glusterfs.c
index c338674ac3c..ee73512e31b 100644
--- a/source3/modules/vfs_glusterfs.c
+++ b/source3/modules/vfs_glusterfs.c
@@ -345,9 +345,12 @@ static int check_for_write_behind_translator(TALLOC_CTX *mem_ctx,
 	if (write_behind_present) {
 		DBG_ERR("Write behind translator is enabled for "
 			"volume (%s), refusing to connect! "
-			"Please check the vfs_glusterfs(8) manpage for "
+			"Please turn off the write behind translator by calling "
+			"'gluster volume set %s performance.write-behind off' "
+			"on the commandline. "
+			"Check the vfs_glusterfs(8) manpage for "
 			"further details.\n",
-			volume);
+			volume, volume);
 		return -1;
 	}
 


-- 
Samba Shared Repository


From kseeger at samba.org  Thu Dec  3 07:33:32 2020
From: kseeger at samba.org (Karolin Seeger)
Date: Thu,  3 Dec 2020 07:33:32 +0000 (UTC)
Subject: [SCM] Samba Shared Repository - branch v4-11-test updated
Message-ID: <20201203073332.71B6814052B@sn.samba.org>

The branch, v4-11-test has been updated
       via  523c71f7ac7 VERSION: Bump version up to 4.11.18...
       via  99f4a3daa25 VERSION: Disable GIT_SNAPSHOT for the 4.11.17 release.
       via  1c76f331a69 WHATSNEW: Add release notes for Samba 4.11.17.
      from  f1b1dc12aba vfs_glusterfs: print exact cmdline for disabling write-behind translator

https://git.samba.org/?p=samba.git;a=shortlog;h=v4-11-test


- Log -----------------------------------------------------------------
commit 523c71f7ac7536bee39b1c397f12082b10d1dbc8
Author: Karolin Seeger <kseeger at samba.org>
Date:   Thu Dec 3 08:31:30 2020 +0100

    VERSION: Bump version up to 4.11.18...
    
    and re-enable GIT_SNAPSHOT.
    
    Signed-off-by: Karolin Seeger <kseeger at samba.org>

commit 99f4a3daa25848fcf0ffd146768d5885be913de6
Author: Karolin Seeger <kseeger at samba.org>
Date:   Thu Dec 3 08:30:31 2020 +0100

    VERSION: Disable GIT_SNAPSHOT for the 4.11.17 release.
    
    Signed-off-by: Karolin Seeger <kseeger at samba.org>

commit 1c76f331a696ffe001b4d997b44f4d86ce48e105
Author: Karolin Seeger <kseeger at samba.org>
Date:   Thu Dec 3 08:20:13 2020 +0100

    WHATSNEW: Add release notes for Samba 4.11.17.
    
    Signed-off-by: Karolin Seeger <kseeger at samba.org>

-----------------------------------------------------------------------

Summary of changes:
 VERSION      |  2 +-
 WHATSNEW.txt | 52 ++++++++++++++++++++++++++++++++++++++++++++++++++--
 2 files changed, 51 insertions(+), 3 deletions(-)


Changeset truncated at 500 lines:

diff --git a/VERSION b/VERSION
index 1c9c15fd82e..35e06c1e36c 100644
--- a/VERSION
+++ b/VERSION
@@ -25,7 +25,7 @@
 ########################################################
 SAMBA_VERSION_MAJOR=4
 SAMBA_VERSION_MINOR=11
-SAMBA_VERSION_RELEASE=17
+SAMBA_VERSION_RELEASE=18
 
 ########################################################
 # If a official release has a serious bug              #
diff --git a/WHATSNEW.txt b/WHATSNEW.txt
index 914e3cc3bf9..b8b5c0009af 100644
--- a/WHATSNEW.txt
+++ b/WHATSNEW.txt
@@ -1,3 +1,51 @@
+                   ===============================
+                   Release Notes for Samba 4.11.17
+                          December 03, 2020
+                   ===============================
+
+
+This is an extraordinary release of the Samba 4.11 release series to fix a
+regression introduced with Samba 4.11.16.
+
+
+Changes since 4.11.16
+---------------------
+
+o  Jeremy Allison <jra at samba.org>
+   * BUG 14486: s3: vfs_glusterfs: Fix the error in preventing talloc leaks from
+     a function.
+
+o  G?nther Deschner <gd at samba.org>
+   * BUG 14486: s3-vfs_glusterfs: Always disable write-behind translator.
+
+o  Anoop C S <anoopcs at samba.org>
+   * BUG 14486: manpages/vfs_glusterfs: Mention silent skipping of write-behind
+     translator.
+
+
+#######################################
+Reporting bugs & Development Discussion
+#######################################
+
+Please discuss this release on the samba-technical mailing list or by
+joining the #samba-technical IRC channel on irc.freenode.net.
+
+If you do report problems then please try to send high quality
+feedback. If you don't provide vital information to help us track down
+the problem then you will probably be ignored.  All bug reports should
+be filed under the Samba 4.1 and newer product in the project's Bugzilla
+database (https://bugzilla.samba.org/).
+
+
+======================================================================
+== Our Code, Our Bugs, Our Responsibility.
+== The Samba Team
+======================================================================
+
+
+Release notes for older releases follow:
+----------------------------------------
+
                    ===============================
                    Release Notes for Samba 4.11.16
                           November 04, 2020
@@ -67,8 +115,8 @@ database (https://bugzilla.samba.org/).
 ======================================================================
 
 
-Release notes for older releases follow:
-----------------------------------------
+----------------------------------------------------------------------
+
 
                    ===============================
                    Release Notes for Samba 4.11.15


-- 
Samba Shared Repository


From kseeger at samba.org  Thu Dec  3 07:36:47 2020
From: kseeger at samba.org (Karolin Seeger)
Date: Thu,  3 Dec 2020 07:36:47 +0000 (UTC)
Subject: [SCM] Samba Shared Repository - annotated tag samba-4.11.17 created
Message-ID: <20201203073648.1636514052B@sn.samba.org>

The annotated tag, samba-4.11.17 has been created
        at  59dc3bd48aa0bcbdb2966ff82ac3a38ea04d18dc (tag)
   tagging  99f4a3daa25848fcf0ffd146768d5885be913de6 (commit)
  replaces  samba-4.11.16
 tagged by  Karolin Seeger
        on  Thu Dec 3 08:36:23 2020 +0100

- Log -----------------------------------------------------------------
samba: tag release samba-4.11.17
-----BEGIN PGP SIGNATURE-----

iF0EABECAB0WIQRS+8C4bZVLCEMyTNxvM5FbZWi36gUCX8iVdwAKCRBvM5FbZWi3
6tx7AJ0ZD8NCFKSICpoXRwZjzreAubU3cwCfW5Pi8/9fDxiRBjUuznIu+obE/Ww=
=ItRL
-----END PGP SIGNATURE-----

Anoop C S (1):
      manpages/vfs_glusterfs: Mention silent skipping of write-behind translator

G?nther Deschner (2):
      s3-vfs_glusterfs: always disable write-behind translator
      vfs_glusterfs: print exact cmdline for disabling write-behind translator

Jeremy Allison (1):
      s3: modules: gluster. Fix the error I made in preventing talloc leaks from a function.

Karolin Seeger (3):
      VERSION: Bump version up to 4.11.17...
      WHATSNEW: Add release notes for Samba 4.11.17.
      VERSION: Disable GIT_SNAPSHOT for the 4.11.17 release.

-----------------------------------------------------------------------


-- 
Samba Shared Repository


From kseeger at samba.org  Thu Dec  3 07:38:47 2020
From: kseeger at samba.org (Karolin Seeger)
Date: Thu,  3 Dec 2020 07:38:47 +0000 (UTC)
Subject: [SCM] Samba Website Repository - branch master updated
Message-ID: <20201203073848.8A15614052B@sn.samba.org>

The branch, master has been updated
       via  388b55f Add Samba 4.11.17 to the list.
       via  5a9a37b NEWS[4.11.17]: Samba 4.11.17 Available for Download
      from  8039336 NEWS[4.11.16]: Samba 4.11.16 Available for Download

https://git.samba.org/?p=samba-web.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 388b55f2744f00735ea5a6ed436603731a563605
Author: Karolin Seeger <kseeger at samba.org>
Date:   Thu Dec 3 08:38:20 2020 +0100

    Add Samba 4.11.17 to the list.
    
    Signed-off-by: Karolin Seeger <kseeger at samba.org>

commit 5a9a37bfaf5202cc7358985c25f54c9ae2705308
Author: Karolin Seeger <kseeger at samba.org>
Date:   Thu Dec 3 08:36:37 2020 +0100

    NEWS[4.11.17]: Samba 4.11.17 Available for Download
    
    Signed-off-by: Karolin Seeger <kseeger at samba.org>

-----------------------------------------------------------------------

Summary of changes:
 history/header_history.html                       |  1 +
 history/samba-4.11.17.html                        | 47 +++++++++++++++++++++++
 posted_news/20201203-073753.4.11.17.body.html     | 13 +++++++
 posted_news/20201203-073753.4.11.17.headline.html |  3 ++
 4 files changed, 64 insertions(+)
 create mode 100644 history/samba-4.11.17.html
 create mode 100644 posted_news/20201203-073753.4.11.17.body.html
 create mode 100644 posted_news/20201203-073753.4.11.17.headline.html


Changeset truncated at 500 lines:

diff --git a/history/header_history.html b/history/header_history.html
index 98f1054..b0db88e 100755
--- a/history/header_history.html
+++ b/history/header_history.html
@@ -23,6 +23,7 @@
 			<li><a href="samba-4.12.2.html">samba-4.12.2</a></li>
 			<li><a href="samba-4.12.1.html">samba-4.12.1</a></li>
 			<li><a href="samba-4.12.0.html">samba-4.12.0</a></li>
+			<li><a href="samba-4.11.17.html">samba-4.11.17</a></li>
 			<li><a href="samba-4.11.16.html">samba-4.11.16</a></li>
 			<li><a href="samba-4.11.15.html">samba-4.11.15</a></li>
 			<li><a href="samba-4.11.14.html">samba-4.11.14</a></li>
diff --git a/history/samba-4.11.17.html b/history/samba-4.11.17.html
new file mode 100644
index 0000000..4913e70
--- /dev/null
+++ b/history/samba-4.11.17.html
@@ -0,0 +1,47 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+ "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<title>Samba 4.11.17 - Release Notes</title>
+</head>
+<body>
+<H2>Samba 4.11.17 Available for Download</H2>
+<p>
+<a href="https://download.samba.org/pub/samba/stable/samba-4.11.17.tar.gz">Samba 4.11.17 (gzipped)</a><br>
+<a href="https://download.samba.org/pub/samba/stable/samba-4.11.17.tar.asc">Signature</a>
+</p>
+<p>
+<a href="https://download.samba.org/pub/samba/patches/samba-4.11.16-4.11.17.diffs.gz">Patch (gzipped) against Samba 4.11.16</a><br>
+<a href="https://download.samba.org/pub/samba/patches/samba-4.11.16-4.11.17.diffs.asc">Signature</a>
+</p>
+<p>
+<pre>
+                   ===============================
+                   Release Notes for Samba 4.11.17
+                          December 03, 2020
+                   ===============================
+
+
+This is an extraordinary release of the Samba 4.11 release series to fix a
+regression introduced with Samba 4.11.16.
+
+
+Changes since 4.11.16
+---------------------
+
+o  Jeremy Allison &lt;jra at samba.org&gt;
+   * BUG 14486: s3: vfs_glusterfs: Fix the error in preventing talloc leaks from
+     a function.
+
+o  G&uuml;nther Deschner &lt;gd at samba.org&gt;
+   * BUG 14486: s3-vfs_glusterfs: Always disable write-behind translator.
+
+o  Anoop C S &lt;anoopcs at samba.org&gt;
+   * BUG 14486: manpages/vfs_glusterfs: Mention silent skipping of write-behind
+     translator.
+
+
+</pre>
+</p>
+</body>
+</html>
diff --git a/posted_news/20201203-073753.4.11.17.body.html b/posted_news/20201203-073753.4.11.17.body.html
new file mode 100644
index 0000000..a1fe110
--- /dev/null
+++ b/posted_news/20201203-073753.4.11.17.body.html
@@ -0,0 +1,13 @@
+<!-- BEGIN: posted_news/20201203-073753.4.11.17.body.html -->
+<h5><a name="4.11.17">03 December 2020</a></h5>
+<p class=headline>Samba 4.11.17 Available for Download</p>
+<p>
+This is the latest stable release of the Samba 4.11 release series.
+</p>
+<p>
+The uncompressed tarball has been signed using GnuPG (ID 6F33915B6568B7EA).
+The source code can be <a href="https://download.samba.org/pub/samba/stable/samba-4.11.17.tar.gz">downloaded now</a>.
+A <a href="https://download.samba.org/pub/samba/patches/samba-4.11.16-4.11.17.diffs.gz">patch against Samba 4.11.16</a> is also available.
+See <a href="https://www.samba.org/samba/history/samba-4.11.17.html">the release notes for more info</a>.
+</p>
+<!-- END: posted_news/20201203-073753.4.11.17.body.html -->
diff --git a/posted_news/20201203-073753.4.11.17.headline.html b/posted_news/20201203-073753.4.11.17.headline.html
new file mode 100644
index 0000000..bc3ce28
--- /dev/null
+++ b/posted_news/20201203-073753.4.11.17.headline.html
@@ -0,0 +1,3 @@
+<!-- BEGIN: posted_news/20201203-073753.4.11.17.headline.html -->
+<li> 03 December 2020 <a href="#4.11.17">Samba 4.11.17 Available for Download</a></li>
+<!-- END: posted_news/20201203-073753.4.11.17.headline.html -->


-- 
Samba Website Repository


From kseeger at samba.org  Thu Dec  3 07:39:04 2020
From: kseeger at samba.org (Karolin Seeger)
Date: Thu,  3 Dec 2020 07:39:04 +0000 (UTC)
Subject: [SCM] Samba Shared Repository - branch v4-11-stable updated
Message-ID: <20201203073905.0B27614052B@sn.samba.org>

The branch, v4-11-stable has been updated
       via  99f4a3daa25 VERSION: Disable GIT_SNAPSHOT for the 4.11.17 release.
       via  1c76f331a69 WHATSNEW: Add release notes for Samba 4.11.17.
       via  f1b1dc12aba vfs_glusterfs: print exact cmdline for disabling write-behind translator
       via  eb525a3e070 manpages/vfs_glusterfs: Mention silent skipping of write-behind translator
       via  d6fb44cba25 s3-vfs_glusterfs: always disable write-behind translator
       via  49710332b59 s3: modules: gluster. Fix the error I made in preventing talloc leaks from a function.
       via  09da9690e93 VERSION: Bump version up to 4.11.17...
      from  9c32d5a99c1 VERSION: Disable GIT_SNAPSHOT for the 4.11.16 release.

https://git.samba.org/?p=samba.git;a=shortlog;h=v4-11-stable


- Log -----------------------------------------------------------------
-----------------------------------------------------------------------

Summary of changes:
 VERSION                               |  2 +-
 WHATSNEW.txt                          | 52 +++++++++++++++++++++++++++++++++--
 docs-xml/manpages/vfs_glusterfs.8.xml |  9 ++++++
 source3/modules/vfs_glusterfs.c       | 47 ++++++++++++++++++++++---------
 source3/wscript                       |  3 ++
 5 files changed, 97 insertions(+), 16 deletions(-)


Changeset truncated at 500 lines:

diff --git a/VERSION b/VERSION
index d9245529268..64eda0f3add 100644
--- a/VERSION
+++ b/VERSION
@@ -25,7 +25,7 @@
 ########################################################
 SAMBA_VERSION_MAJOR=4
 SAMBA_VERSION_MINOR=11
-SAMBA_VERSION_RELEASE=16
+SAMBA_VERSION_RELEASE=17
 
 ########################################################
 # If a official release has a serious bug              #
diff --git a/WHATSNEW.txt b/WHATSNEW.txt
index 914e3cc3bf9..b8b5c0009af 100644
--- a/WHATSNEW.txt
+++ b/WHATSNEW.txt
@@ -1,3 +1,51 @@
+                   ===============================
+                   Release Notes for Samba 4.11.17
+                          December 03, 2020
+                   ===============================
+
+
+This is an extraordinary release of the Samba 4.11 release series to fix a
+regression introduced with Samba 4.11.16.
+
+
+Changes since 4.11.16
+---------------------
+
+o  Jeremy Allison <jra at samba.org>
+   * BUG 14486: s3: vfs_glusterfs: Fix the error in preventing talloc leaks from
+     a function.
+
+o  G?nther Deschner <gd at samba.org>
+   * BUG 14486: s3-vfs_glusterfs: Always disable write-behind translator.
+
+o  Anoop C S <anoopcs at samba.org>
+   * BUG 14486: manpages/vfs_glusterfs: Mention silent skipping of write-behind
+     translator.
+
+
+#######################################
+Reporting bugs & Development Discussion
+#######################################
+
+Please discuss this release on the samba-technical mailing list or by
+joining the #samba-technical IRC channel on irc.freenode.net.
+
+If you do report problems then please try to send high quality
+feedback. If you don't provide vital information to help us track down
+the problem then you will probably be ignored.  All bug reports should
+be filed under the Samba 4.1 and newer product in the project's Bugzilla
+database (https://bugzilla.samba.org/).
+
+
+======================================================================
+== Our Code, Our Bugs, Our Responsibility.
+== The Samba Team
+======================================================================
+
+
+Release notes for older releases follow:
+----------------------------------------
+
                    ===============================
                    Release Notes for Samba 4.11.16
                           November 04, 2020
@@ -67,8 +115,8 @@ database (https://bugzilla.samba.org/).
 ======================================================================
 
 
-Release notes for older releases follow:
-----------------------------------------
+----------------------------------------------------------------------
+
 
                    ===============================
                    Release Notes for Samba 4.11.15
diff --git a/docs-xml/manpages/vfs_glusterfs.8.xml b/docs-xml/manpages/vfs_glusterfs.8.xml
index 7a4da1af919..d25135e14ac 100644
--- a/docs-xml/manpages/vfs_glusterfs.8.xml
+++ b/docs-xml/manpages/vfs_glusterfs.8.xml
@@ -179,7 +179,16 @@
                 translator and refuse to connect if detected.
                 Please disable the write-behind translator for the GlusterFS
                 volume to allow the plugin to connect to the volume.
+                The write-behind translator can easily be disabled via calling
+                <programlisting>
+                        gluster volume set &lt;volumename&gt; performance.write-behind off
+                </programlisting> on the commandline.
 	</para>
+        <para>
+                With GlusterFS versions >= 9, we silently bypass write-behind
+                translator during initial connect and failure is avoided.
+        </para>
+
 </refsect1>
 
 
diff --git a/source3/modules/vfs_glusterfs.c b/source3/modules/vfs_glusterfs.c
index 747176ecebb..ce31b5eba14 100644
--- a/source3/modules/vfs_glusterfs.c
+++ b/source3/modules/vfs_glusterfs.c
@@ -315,15 +315,25 @@ static int check_for_write_behind_translator(TALLOC_CTX *mem_ctx,
 		return -1;
 	}
 
+	/*
+	 * file_lines_parse() plays horrible tricks with
+	 * the passed-in talloc pointers and the hierarcy
+	 * which makes freeing hard to get right.
+	 *
+	 * As we know mem_ctx is freed by the caller, after
+	 * this point don't free on exit and let the caller
+	 * handle it. This violates good Samba coding practice
+	 * but we know we're not leaking here.
+	 */
+
 	lines = file_lines_parse(buf,
 				newlen,
 				&numlines,
 				mem_ctx);
 	if (lines == NULL || numlines <= 0) {
-		TALLOC_FREE(option);
-		TALLOC_FREE(buf);
 		return -1;
 	}
+	/* On success, buf is now a talloc child of lines !! */
 
 	for (i=0; i < numlines; i++) {
 		if (strequal(lines[i], option)) {
@@ -335,18 +345,15 @@ static int check_for_write_behind_translator(TALLOC_CTX *mem_ctx,
 	if (write_behind_present) {
 		DBG_ERR("Write behind translator is enabled for "
 			"volume (%s), refusing to connect! "
-			"Please check the vfs_glusterfs(8) manpage for "
+			"Please turn off the write behind translator by calling "
+			"'gluster volume set %s performance.write-behind off' "
+			"on the commandline. "
+			"Check the vfs_glusterfs(8) manpage for "
 			"further details.\n",
-			volume);
-		TALLOC_FREE(lines);
-		TALLOC_FREE(option);
-		TALLOC_FREE(buf);
+			volume, volume);
 		return -1;
 	}
 
-	TALLOC_FREE(lines);
-	TALLOC_FREE(option);
-	TALLOC_FREE(buf);
 	return 0;
 }
 
@@ -361,6 +368,7 @@ static int vfs_gluster_connect(struct vfs_handle_struct *handle,
 	glfs_t *fs = NULL;
 	TALLOC_CTX *tmp_ctx;
 	int ret = 0;
+	bool write_behind_pass_through_set = false;
 
 	tmp_ctx = talloc_new(NULL);
 	if (tmp_ctx == NULL) {
@@ -420,6 +428,17 @@ static int vfs_gluster_connect(struct vfs_handle_struct *handle,
 		goto done;
 	}
 
+#ifdef HAVE_GFAPI_VER_7_9
+	ret = glfs_set_xlator_option(fs, "*-write-behind", "pass-through",
+				     "true");
+	if (ret < 0) {
+		DBG_ERR("%s: Failed to set xlator option: pass-through\n",
+			volume);
+		goto done;
+	}
+	write_behind_pass_through_set = true;
+#endif
+
 	ret = glfs_set_logging(fs, logfile, loglevel);
 	if (ret < 0) {
 		DEBUG(0, ("%s: Failed to set logfile %s loglevel %d\n",
@@ -434,9 +453,11 @@ static int vfs_gluster_connect(struct vfs_handle_struct *handle,
 		goto done;
 	}
 
-	ret = check_for_write_behind_translator(tmp_ctx, fs, volume);
-	if (ret < 0) {
-		goto done;
+	if (!write_behind_pass_through_set) {
+		ret = check_for_write_behind_translator(tmp_ctx, fs, volume);
+		if (ret < 0) {
+			goto done;
+		}
 	}
 
 	ret = glfs_set_preopened(volume, handle->conn->connectpath, fs);
diff --git a/source3/wscript b/source3/wscript
index 7b257bcb845..47f97c60321 100644
--- a/source3/wscript
+++ b/source3/wscript
@@ -1591,6 +1591,9 @@ main() {
         conf.CHECK_CFG(package='glusterfs-api', args='"glusterfs-api >= 7.6" --cflags --libs',
                        msg='Checking for glusterfs-api >= 7.6',
                        uselib_store="GFAPI_VER_7_6")
+        conf.CHECK_CFG(package='glusterfs-api', args='"glusterfs-api >= 7.9" --cflags --libs',
+                       msg='Checking for glusterfs-api >= 7.9',
+                       uselib_store="GFAPI_VER_7_9")
     else:
         conf.SET_TARGET_TYPE('gfapi', 'EMPTY')
         conf.undefine('HAVE_GLUSTERFS')


-- 
Samba Shared Repository


From asn at samba.org  Thu Dec  3 13:20:42 2020
From: asn at samba.org (Andreas Schneider)
Date: Thu,  3 Dec 2020 13:20:42 +0000 (UTC)
Subject: [SCM] pam wrapper repository - branch master updated
Message-ID: <20201203132042.9C9CC1401E6@sn.samba.org>

The branch, master has been updated
       via  7401af4 pam_wrapper.c: fall back to pragma init/fini for constructor/destructor if possible
       via  f7ba680 configure: check for pragma init/fini for constructors/destructors
      from  ab2d90c Bump version to 1.1.3

https://git.samba.org/?p=pam_wrapper.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 7401af4dbe1a8dc5849c3d7fc2a7890413ab394e
Author: Bj?rn Jacke <bjacke at samba.org>
Date:   Fri Oct 30 15:52:40 2020 +0100

    pam_wrapper.c: fall back to pragma init/fini for constructor/destructor if possible
    
    Signed-off-by: Bjoern Jacke <bjacke at samba.org>
    Reviewed-by: Andreas Schneider <asn at samba.org>

commit f7ba680493ec6ae191a633799682eededdea1d83
Author: Bj?rn Jacke <bjacke at samba.org>
Date:   Fri Oct 30 15:51:38 2020 +0100

    configure: check for pragma init/fini for constructors/destructors
    
    Signed-off-by: Bjoern Jacke <bjacke at samba.org>
    Reviewed-by: Andreas Schneider <asn at samba.org>

-----------------------------------------------------------------------

Summary of changes:
 ConfigureChecks.cmake | 26 ++++++++++++++++++++++++++
 config.h.cmake        |  2 ++
 src/pam_wrapper.c     |  7 +++++++
 3 files changed, 35 insertions(+)


Changeset truncated at 500 lines:

diff --git a/ConfigureChecks.cmake b/ConfigureChecks.cmake
index 8dcf978..dcf5f31 100644
--- a/ConfigureChecks.cmake
+++ b/ConfigureChecks.cmake
@@ -140,6 +140,32 @@ int main(void) {
     return 0;
 }" HAVE_DESTRUCTOR_ATTRIBUTE)
 
+check_c_source_compiles("
+#pragma init (test_constructor)
+void test_constructor(void);
+
+void test_constructor(void)
+{
+     return;
+}
+
+int main(void) {
+     return 0;
+}" HAVE_PRAGMA_INIT)
+
+check_c_source_compiles("
+#pragma fini (test_destructor)
+void test_destructor(void);
+
+void test_destructor(void)
+{
+    return;
+}
+
+int main(void) {
+    return 0;
+}" HAVE_PRAGMA_FINI)
+
 check_c_source_compiles("
 void log_fn(const char *format, ...) __attribute__ ((format (printf, 1, 2)));
 
diff --git a/config.h.cmake b/config.h.cmake
index 01a54f3..80208aa 100644
--- a/config.h.cmake
+++ b/config.h.cmake
@@ -40,6 +40,8 @@
 #cmakedefine HAVE_GCC_ATOMIC_BUILTINS 1
 #cmakedefine HAVE_CONSTRUCTOR_ATTRIBUTE 1
 #cmakedefine HAVE_DESTRUCTOR_ATTRIBUTE 1
+#cmakedefine HAVE_PRAGMA_INIT 1
+#cmakedefine HAVE_PRAGMA_FINI 1
 #cmakedefine HAVE_FUNCTION_ATTRIBUTE_FORMAT 1
 
 /*************************** ENDIAN *****************************/
diff --git a/src/pam_wrapper.c b/src/pam_wrapper.c
index dd69c43..6801d7b 100644
--- a/src/pam_wrapper.c
+++ b/src/pam_wrapper.c
@@ -311,7 +311,14 @@ static struct pwrap pwrap;
  *********************************************************/
 
 bool pam_wrapper_enabled(void);
+#if ! defined(HAVE_CONSTRUCTOR_ATTRIBUTE) && defined(HAVE_PRAGMA_INIT)
+/* xlC and other oldschool compilers support (only) this */
+#pragma init (pwrap_constructor)
+#endif
 void pwrap_constructor(void) CONSTRUCTOR_ATTRIBUTE;
+#if ! defined(HAVE_DESTRUCTOR_ATTRIBUTE) && defined(HAVE_PRAGMA_FINI)
+#pragma fini (pwrap_destructor)
+#endif
 void pwrap_destructor(void) DESTRUCTOR_ATTRIBUTE;
 
 /*********************************************************


-- 
pam wrapper repository


From jra at samba.org  Fri Dec  4 20:55:07 2020
From: jra at samba.org (Jeremy Allison)
Date: Fri,  4 Dec 2020 20:55:07 +0000 (UTC)
Subject: [SCM] Samba Shared Repository - branch master updated
Message-ID: <20201204205507.E079F1402E9@sn.samba.org>

The branch, master has been updated
       via  8a0a7359fab s3: smbd: Quiet log messages from usershares for an unknown share.
      from  936f74daed0 vfs_zfsacl: add missing inherited flag on hidden "magic" everyone@ ACE

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 8a0a7359faba642baf55a8f98ff78c0d0884d0f0
Author: Jeremy Allison <jra at samba.org>
Date:   Wed Dec 2 11:47:02 2020 -0800

    s3: smbd: Quiet log messages from usershares for an unknown share.
    
    No need to log missing shares/sharenames at debug level zero.
    
    Keep the debug level zero for all other usershare problems.
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14590
    
    Signed-off-by: Jeremy Allison <jra at samba.org>
    Reviewed-by: Rowland penny <rpenny at samba.org>
    Reviewed-by: Andrew Bartlett <abartlet at samba.org>
    
    Autobuild-User(master): Jeremy Allison <jra at samba.org>
    Autobuild-Date(master): Fri Dec  4 20:54:06 UTC 2020 on sn-devel-184

-----------------------------------------------------------------------

Summary of changes:
 source3/param/loadparm.c | 10 ++++++++++
 1 file changed, 10 insertions(+)


Changeset truncated at 500 lines:

diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c
index fbeed6782ad..3de22b350f1 100644
--- a/source3/param/loadparm.c
+++ b/source3/param/loadparm.c
@@ -3424,6 +3424,11 @@ static int process_usershare_file(const char *dir_name, const char *file_name, i
 	   open and fstat. Ensure this isn't a symlink link. */
 
 	if (sys_lstat(fname, &lsbuf, false) != 0) {
+		if (errno == ENOENT) {
+			/* Unknown share requested. Just ignore. */
+			goto out;
+		}
+		/* Only log messages for meaningful problems. */
 		DEBUG(0,("process_usershare_file: stat of %s failed. %s\n",
 			fname, strerror(errno) ));
 		goto out;
@@ -3629,6 +3634,11 @@ int load_usershare_service(const char *servicename)
 	int max_user_shares = Globals.usershare_max_shares;
 	int snum_template = -1;
 
+	if (servicename[0] == '\0') {
+		/* Invalid service name. */
+		return -1;
+	}
+
 	if (*usersharepath == 0 ||  max_user_shares == 0) {
 		return -1;
 	}


-- 
Samba Shared Repository


From jra at samba.org  Fri Dec  4 22:33:05 2020
From: jra at samba.org (Jeremy Allison)
Date: Fri,  4 Dec 2020 22:33:05 +0000 (UTC)
Subject: [SCM] Samba Shared Repository - branch master updated
Message-ID: <20201204223305.980F41402E9@sn.samba.org>

The branch, master has been updated
       via  bbd94522b1e smbd: Remove "have_share_modes" from "struct share_mode_data"
       via  1ba4672ee90 smbd: Simplify share_mode_entry_do()
       via  7677c40fa55 smbd: Remove a comment that was not helpful for me
       via  05f9e8f9997 smbd: Simplify share_mode_lock_destructor()
       via  0f40c4ab637 smbd: Remove unused share_mode_have_entries()
       via  b712bd8173f smbd: Simplify open_mode_check()
       via  2c7e8e3fc5c smbd: Simplify share_mode_memcache_fetch()
       via  a8d2654d52b build: Fix kernel oplock test
       via  7d04b5a705f smbd: Align integer types
       via  18146c6285f spoolssd: Align integer types
       via  3bf9973d21f clitar: Align integer types
       via  441fdc1280b lib: Align integer types
      from  8a0a7359fab s3: smbd: Quiet log messages from usershares for an unknown share.

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit bbd94522b1e626ed1a4e87c297cfebe982fdbbce
Author: Volker Lendecke <vl at samba.org>
Date:   Thu Dec 3 17:16:25 2020 +0100

    smbd: Remove "have_share_modes" from "struct share_mode_data"
    
    Nobody in share_mode_lock.c looked at that value anymore, so we don't
    need to manually maintain it.
    
    Signed-off-by: Volker Lendecke <vl at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>
    
    Autobuild-User(master): Jeremy Allison <jra at samba.org>
    Autobuild-Date(master): Fri Dec  4 22:32:38 UTC 2020 on sn-devel-184

commit 1ba4672ee909251d41d2edb9af957549a72a1a36
Author: Volker Lendecke <vl at samba.org>
Date:   Thu Dec 3 17:12:20 2020 +0100

    smbd: Simplify share_mode_entry_do()
    
    Rely on the truth in locking.tdb wrt existence of share entries
    
    Signed-off-by: Volker Lendecke <vl at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 7677c40fa5587e0ac29427639011ae4e7c562d04
Author: Volker Lendecke <vl at samba.org>
Date:   Thu Dec 3 17:03:32 2020 +0100

    smbd: Remove a comment that was not helpful for me
    
    Also avoid an "else" branch
    
    Signed-off-by: Volker Lendecke <vl at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 05f9e8f9997a4e72be69ca085db0c6efbffade78
Author: Volker Lendecke <vl at samba.org>
Date:   Thu Dec 3 17:02:10 2020 +0100

    smbd: Simplify share_mode_lock_destructor()
    
    Rely on the truth in the database whether we found share modes or
    not, share_mode_data_store() has that information for free.
    
    Signed-off-by: Volker Lendecke <vl at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 0f40c4ab637cb0f74f0dbdf93611fe55b69c7f35
Author: Volker Lendecke <vl at samba.org>
Date:   Thu Dec 3 16:23:58 2020 +0100

    smbd: Remove unused share_mode_have_entries()
    
    Signed-off-by: Volker Lendecke <vl at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit b712bd8173f860be25652420ac94db265003fd62
Author: Volker Lendecke <vl at samba.org>
Date:   Thu Dec 3 16:18:25 2020 +0100

    smbd: Simplify open_mode_check()
    
    The call to share_mode_have_entries() was put in before
    fresh_share_mode_lock() initialized d->flags to be completely
    permissive. With that correct initialization the call to
    share_conflict() a few lines down will also make open_mode_check()
    pass for any share_access/access_mask.
    
    Signed-off-by: Volker Lendecke <vl at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 2c7e8e3fc5c04326bae7bd4de69c6a41e5c2bf43
Author: Volker Lendecke <vl at samba.org>
Date:   Tue Dec 1 13:50:32 2020 +0100

    smbd: Simplify share_mode_memcache_fetch()
    
    Take a struct file_id instead of a locking.tdb key,
    share_mode_memcache_store() also operates on the implicit fid in
    struct share_mode_data.
    
    To do this, parse_share_modes() also needs to take file_id.
    
    Signed-off-by: Volker Lendecke <vl at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit a8d2654d52bd8539eb73cafe9da5666aad7c7d50
Author: Volker Lendecke <vl at samba.org>
Date:   Fri Nov 20 14:19:21 2020 +0100

    build: Fix kernel oplock test
    
    In a pure docker environment with overlayfs F_GETLEASE works on /tmp,
    but F_SETLEASE does not. This test now correctly detects that.
    
    The effect is that the samba-fileserver environment would run fine in
    a shared gitlab runner, at the price of not testing kernel oplocks. We
    could move the kernel oplock tests to another environment that for
    other reasons can't run on shared gitlab runners.
    
    Signed-off-by: Volker Lendecke <vl at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 7d04b5a705f0e97ae568a40b1d5fb13483e9afab
Author: Volker Lendecke <vl at samba.org>
Date:   Tue Dec 1 13:27:11 2020 +0100

    smbd: Align integer types
    
    full_path_tos() return ssize_t
    
    Signed-off-by: Volker Lendecke <vl at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 18146c6285fa5a7f7e17dbe8b5481679ce8b8e2b
Author: Volker Lendecke <vl at samba.org>
Date:   Thu Dec 3 16:23:39 2020 +0100

    spoolssd: Align integer types
    
    Signed-off-by: Volker Lendecke <vl at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 3bf9973d21ffb261bbf8cbf257935c6c66855fe6
Author: Volker Lendecke <vl at samba.org>
Date:   Wed Dec 2 11:13:11 2020 +0100

    clitar: Align integer types
    
    Signed-off-by: Volker Lendecke <vl at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 441fdc1280bc2158a3bc7cf9c9896cf93b7c8be3
Author: Volker Lendecke <vl at samba.org>
Date:   Mon Nov 30 13:39:15 2020 +0100

    lib: Align integer types
    
    Signed-off-by: Volker Lendecke <vl at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

-----------------------------------------------------------------------

Summary of changes:
 source3/client/clitar.c           |  2 +-
 source3/lib/tldap.c               |  3 +-
 source3/librpc/idl/open_files.idl |  1 -
 source3/locking/share_mode_lock.c | 86 +++++++++++++++------------------------
 source3/locking/share_mode_lock.h |  1 -
 source3/printing/spoolssd.c       |  2 +-
 source3/smbd/dir.c                |  4 +-
 source3/smbd/open.c               | 11 +----
 source3/wscript                   |  8 +++-
 9 files changed, 45 insertions(+), 73 deletions(-)


Changeset truncated at 500 lines:

diff --git a/source3/client/clitar.c b/source3/client/clitar.c
index 4fd1f3c47d9..7348420db5e 100644
--- a/source3/client/clitar.c
+++ b/source3/client/clitar.c
@@ -272,7 +272,6 @@ int cmd_tarmode(void)
 {
 	const extern char *cmd_ptr;
 	char *buf;
-	int i;
 	TALLOC_CTX *ctx;
 
 	struct {
@@ -298,6 +297,7 @@ int cmd_tarmode(void)
 	}
 
 	while (next_token_talloc(ctx, &cmd_ptr, &buf, NULL)) {
+		size_t i;
 		for (i = 0; i < ARRAY_SIZE(table); i++) {
 			if (strequal(table[i].cmd, buf)) {
 				*table[i].p = table[i].value;
diff --git a/source3/lib/tldap.c b/source3/lib/tldap.c
index 0e39a307728..e008b04e5e6 100644
--- a/source3/lib/tldap.c
+++ b/source3/lib/tldap.c
@@ -666,7 +666,8 @@ static void tldap_msg_received(struct tevent_req *subreq)
 	uint8_t *inbuf;
 	ssize_t received;
 	size_t num_pending;
-	int i, err;
+	size_t i;
+	int err;
 	TLDAPRC status = TLDAP_PROTOCOL_ERROR;
 	int id;
 	uint8_t type;
diff --git a/source3/librpc/idl/open_files.idl b/source3/librpc/idl/open_files.idl
index 891ff1f763d..49bc09d77b6 100644
--- a/source3/librpc/idl/open_files.idl
+++ b/source3/librpc/idl/open_files.idl
@@ -64,7 +64,6 @@ interface open_files
 		NTTIME changed_write_time;
 		[skip] boolean8 fresh;
 		[skip] boolean8 modified;
-		[skip] boolean8 have_share_modes;
 		[ignore] file_id id; /* In memory key used to lookup cache. */
 	} share_mode_data;
 
diff --git a/source3/locking/share_mode_lock.c b/source3/locking/share_mode_lock.c
index c9012f7454b..8ad9341a765 100644
--- a/source3/locking/share_mode_lock.c
+++ b/source3/locking/share_mode_lock.c
@@ -274,26 +274,17 @@ static int share_mode_data_nofree_destructor(struct share_mode_data *d)
 
 static struct share_mode_data *share_mode_memcache_fetch(
 	TALLOC_CTX *mem_ctx,
-	const TDB_DATA id_key,
+	struct file_id id,
 	const uint8_t *buf,
 	size_t buflen)
 {
+	const DATA_BLOB key = memcache_key(&id);
 	enum ndr_err_code ndr_err;
 	struct share_mode_data *d;
 	uint64_t unique_content_epoch;
 	uint16_t flags;
 	void *ptr;
-	struct file_id id;
 	struct file_id_buf idbuf;
-	DATA_BLOB key;
-
-	/* Ensure this is a locking_key record. */
-	if (id_key.dsize != sizeof(id)) {
-		return NULL;
-	}
-
-	memcpy(&id, id_key.dptr, id_key.dsize);
-	key = memcache_key(&id);
 
 	ptr = memcache_lookup_talloc(NULL,
 			SHARE_MODE_LOCK_CACHE,
@@ -592,7 +583,7 @@ static NTSTATUS locking_tdb_data_store(
 
 static struct share_mode_data *parse_share_modes(
 	TALLOC_CTX *mem_ctx,
-	const TDB_DATA key,
+	struct file_id id,
 	const uint8_t *buf,
 	size_t buflen)
 {
@@ -601,7 +592,7 @@ static struct share_mode_data *parse_share_modes(
 	DATA_BLOB blob;
 
 	/* See if we already have a cached copy of this key. */
-	d = share_mode_memcache_fetch(mem_ctx, key, buf, buflen);
+	d = share_mode_memcache_fetch(mem_ctx, id, buf, buflen);
 	if (d != NULL) {
 		return d;
 	}
@@ -629,14 +620,6 @@ static struct share_mode_data *parse_share_modes(
 		NDR_PRINT_DEBUG(share_mode_data, d);
 	}
 
-	/*
-	 * We have a non-zero locking.tdb record that was correctly
-	 * parsed. This means a share_entries.tdb entry exists,
-	 * otherwise we'd have paniced before in
-	 * share_mode_data_store()
-	 */
-	d->have_share_modes = true;
-
 	return d;
 fail:
 	TALLOC_FREE(d);
@@ -647,7 +630,8 @@ fail:
  If modified, store the share_mode_data back into the database.
 ********************************************************************/
 
-static NTSTATUS share_mode_data_store(struct share_mode_data *d)
+static NTSTATUS share_mode_data_store(
+	struct share_mode_data *d, bool *have_share_entries)
 {
 	TDB_DATA key = locking_key(&d->id);
 	struct locking_tdb_data *ltdb = NULL;
@@ -685,6 +669,8 @@ static NTSTATUS share_mode_data_store(struct share_mode_data *d)
 			TALLOC_FREE(ltdb);
 			return ndr_map_error2ntstatus(ndr_err);
 		}
+
+		*have_share_entries = true;
 	}
 
 	ltdb->share_mode_data_buf = blob.data;
@@ -786,7 +772,6 @@ static void get_static_share_mode_data_fn(
 	void *private_data)
 {
 	struct get_static_share_mode_data_state *state = private_data;
-	TDB_DATA key = locking_key(&state->id);
 	struct share_mode_data *d = NULL;
 	struct locking_tdb_data ltdb = { 0 };
 
@@ -818,7 +803,7 @@ static void get_static_share_mode_data_fn(
 	} else {
 		d = parse_share_modes(
 			lock_ctx,
-			key,
+			state->id,
 			ltdb.share_mode_data_buf,
 			ltdb.share_mode_data_len);
 		if (d == NULL) {
@@ -957,6 +942,7 @@ fail:
 
 static int share_mode_lock_destructor(struct share_mode_lock *lck)
 {
+	bool have_share_entries = false;
 	NTSTATUS status;
 
 	SMB_ASSERT(static_share_mode_data_refcount > 0);
@@ -966,7 +952,8 @@ static int share_mode_lock_destructor(struct share_mode_lock *lck)
 		return 0;
 	}
 
-	status = share_mode_data_store(static_share_mode_data);
+	status = share_mode_data_store(
+		static_share_mode_data, &have_share_entries);
 	if (!NT_STATUS_IS_OK(status)) {
 		DBG_ERR("share_mode_data_store failed: %s\n",
 			nt_errstr(status));
@@ -985,7 +972,7 @@ static int share_mode_lock_destructor(struct share_mode_lock *lck)
 		}
 	}
 
-	if (static_share_mode_data->have_share_modes) {
+	if (have_share_entries) {
 		/*
 		 * This is worth keeping. Without share modes,
 		 * share_mode_data_store above has left nothing in the
@@ -993,17 +980,9 @@ static int share_mode_lock_destructor(struct share_mode_lock *lck)
 		 */
 		share_mode_memcache_store(static_share_mode_data);
 		static_share_mode_data = NULL;
-	} else {
-		/*
-		 * The next opener of this file will find an empty
-		 * locking.tdb record. Don't store the share_mode_data
-		 * in the memcache, fresh_share_mode_lock() will
-		 * generate a fresh seqnum anyway, obsoleting the
-		 * cache entry.
-		 */
-		TALLOC_FREE(static_share_mode_data);
 	}
 
+	TALLOC_FREE(static_share_mode_data);
 	return 0;
 }
 
@@ -1117,11 +1096,6 @@ NTSTATUS share_mode_wakeup_waiters(struct file_id id)
 	return share_mode_do_locked(id, share_mode_wakeup_waiters_fn, NULL);
 }
 
-bool share_mode_have_entries(struct share_mode_lock *lck)
-{
-	return lck->data->have_share_modes;
-}
-
 NTTIME share_mode_changed_write_time(struct share_mode_lock *lck)
 {
 	return lck->data->changed_write_time;
@@ -1324,7 +1298,7 @@ NTSTATUS share_mode_watch_recv(
 
 struct fetch_share_mode_unlocked_state {
 	TALLOC_CTX *mem_ctx;
-	TDB_DATA key;
+	struct file_id id;
 	struct share_mode_lock *lck;
 };
 
@@ -1360,7 +1334,7 @@ static void fetch_share_mode_unlocked_parser(
 
 	state->lck->data = parse_share_modes(
 		state->lck,
-		state->key,
+		state->id,
 		ltdb.share_mode_data_buf,
 		ltdb.share_mode_data_len);
 	if (state->lck->data == NULL) {
@@ -1379,12 +1353,13 @@ struct share_mode_lock *fetch_share_mode_unlocked(TALLOC_CTX *mem_ctx,
 {
 	struct fetch_share_mode_unlocked_state state = {
 		.mem_ctx = mem_ctx,
-		.key = locking_key(&id),
+		.id = id,
 	};
+	TDB_DATA key = locking_key(&id);
 	NTSTATUS status;
 
 	status = g_lock_dump(
-		lock_ctx, state.key, fetch_share_mode_unlocked_parser, &state);
+		lock_ctx, key, fetch_share_mode_unlocked_parser, &state);
 	if (!NT_STATUS_IS_OK(status)) {
 		DBG_DEBUG("g_lock_dump failed: %s\n", nt_errstr(status));
 		return NULL;
@@ -1497,7 +1472,7 @@ static void fetch_share_mode_fn(
 
 	state->lck->data = parse_share_modes(
 		state->lck,
-		locking_key(&state->id),
+		state->id,
 		ltdb.share_mode_data_buf,
 		ltdb.share_mode_data_len);
 	if (state->lck->data == NULL) {
@@ -1593,7 +1568,7 @@ static void share_mode_forall_dump_fn(
 
 	d = parse_share_modes(
 		talloc_tos(),
-		state->key,
+		fid,
 		ltdb.share_mode_data_buf,
 		ltdb.share_mode_data_len);
 	if (d == NULL) {
@@ -1892,7 +1867,6 @@ bool set_share_mode(struct share_mode_lock *lck,
 		/*
 		 * Storing a fresh record with just one share entry
 		 */
-		d->have_share_modes = true;
 		d->modified = true;
 	}
 
@@ -2086,9 +2060,9 @@ bool share_mode_forall_entries(
 
 	if ((ltdb->num_share_entries != 0 ) && (num_share_entries == 0)) {
 		/*
-		 * This routine wiped all share entries
+		 * This routine wiped all share entries, let
+		 * share_mode_data_store() delete the record
 		 */
-		d->have_share_modes = false;
 		d->modified = true;
 	}
 
@@ -2177,7 +2151,7 @@ static bool share_mode_entry_do(
 	bool modified;
 	struct share_mode_entry e;
 	uint8_t *e_ptr = NULL;
-	bool have_share_modes;
+	bool had_share_entries, have_share_entries;
 	NTSTATUS status;
 	bool ret = false;
 
@@ -2189,6 +2163,8 @@ static bool share_mode_entry_do(
 	}
 	DBG_DEBUG("num_share_modes=%zu\n", ltdb->num_share_entries);
 
+	had_share_entries = (ltdb->num_share_entries != 0);
+
 	idx = share_mode_entry_find(
 		ltdb->share_entries,
 		ltdb->num_share_entries,
@@ -2265,9 +2241,12 @@ static bool share_mode_entry_do(
 		goto done;
 	}
 
-	have_share_modes = (ltdb->num_share_entries != 0);
-	if (d->have_share_modes != have_share_modes) {
-		d->have_share_modes = have_share_modes;
+	have_share_entries = (ltdb->num_share_entries != 0);
+	if (had_share_entries != have_share_entries) {
+		/*
+		 * Make share_mode_data_store do the right thing wrt
+		 * possibly deleting the locking.tdb record
+		 */
 		d->modified = true;
 	}
 
@@ -2533,7 +2512,6 @@ bool reset_share_mode_entry(
 		goto done;
 	}
 
-	d->have_share_modes = true;
 	d->modified = true;
 	ret = true;
 done:
diff --git a/source3/locking/share_mode_lock.h b/source3/locking/share_mode_lock.h
index 09a354c0d01..f2fe3d51a16 100644
--- a/source3/locking/share_mode_lock.h
+++ b/source3/locking/share_mode_lock.h
@@ -94,7 +94,6 @@ bool share_mode_forall_entries(
 		   bool *modified,
 		   void *private_data),
 	void *private_data);
-bool share_mode_have_entries(struct share_mode_lock *lck);
 
 NTTIME share_mode_changed_write_time(struct share_mode_lock *lck);
 const char *share_mode_servicepath(struct share_mode_lock *lck);
diff --git a/source3/printing/spoolssd.c b/source3/printing/spoolssd.c
index babec72e299..cd1f4b2188a 100644
--- a/source3/printing/spoolssd.c
+++ b/source3/printing/spoolssd.c
@@ -586,7 +586,7 @@ static NTSTATUS spoolssd_create_sockets(struct tevent_context *ev_ctx,
 	int fd = -1;
 	int rc;
 	enum rpc_service_mode_e epm_mode = rpc_epmapper_mode();
-	uint32_t i;
+	int i;
 	struct dcesrv_endpoint *e = NULL;
 
 	DBG_INFO("Initializing DCE/RPC connection endpoints\n");
diff --git a/source3/smbd/dir.c b/source3/smbd/dir.c
index 5602fa9ea15..73eb2d17166 100644
--- a/source3/smbd/dir.c
+++ b/source3/smbd/dir.c
@@ -1640,7 +1640,7 @@ bool SearchDir(struct smb_Dir *dir_hnd, const char *name, long *poffset)
 
 struct files_below_forall_state {
 	char *dirpath;
-	size_t dirpath_len;
+	ssize_t dirpath_len;
 	int (*fn)(struct file_id fid, const struct share_mode_data *data,
 		  void *private_data);
 	void *private_data;
@@ -1653,7 +1653,7 @@ static int files_below_forall_fn(struct file_id fid,
 	struct files_below_forall_state *state = private_data;
 	char tmpbuf[PATH_MAX];
 	char *fullpath, *to_free;
-	size_t len;
+	ssize_t len;
 
 	len = full_path_tos(data->servicepath, data->base_name,
 			    tmpbuf, sizeof(tmpbuf),
diff --git a/source3/smbd/open.c b/source3/smbd/open.c
index 3f5bc89cefe..bf612970458 100644
--- a/source3/smbd/open.c
+++ b/source3/smbd/open.c
@@ -1761,7 +1761,7 @@ static NTSTATUS open_mode_check(connection_struct *conn,
 				uint32_t share_access)
 {
 	struct open_mode_check_state state;
-	bool ok, conflict, have_share_entries;
+	bool ok, conflict;
 	bool modified = false;
 
 	if (is_oplock_stat_open(access_mask)) {
@@ -1787,15 +1787,6 @@ static NTSTATUS open_mode_check(connection_struct *conn,
 	}
 #endif
 
-	have_share_entries = share_mode_have_entries(lck);
-	if (!have_share_entries) {
-		/*
-		 * This is a fresh share mode lock where no conflicts
-		 * can happen.
-		 */
-		return NT_STATUS_OK;
-	}
-
 	share_mode_flags_get(
 		lck, &state.access_mask, &state.share_access, NULL);
 
diff --git a/source3/wscript b/source3/wscript
index 011594b3844..a370fae667f 100644
--- a/source3/wscript
+++ b/source3/wscript
@@ -184,8 +184,12 @@ main() {
 #ifndef F_GETLEASE
 #define F_GETLEASE 1025
 #endif
-main() {
-        exit(fcntl(open("/tmp", O_RDONLY), F_GETLEASE, 0) == -1 ?  1 : 0);
+int main() {
+	const char *fname="/tmp/oplock-test.txt";
+	int fd = open(fname, O_RDWR|O_CREAT, 0644);
+	int ret = fcntl(fd, F_SETLEASE, F_WRLCK);
+	unlink(fname);
+	return (ret == -1) ? 1 : 0;
 }''', 'HAVE_KERNEL_OPLOCKS_LINUX', addmain=False, execute=True,
         msg="Checking for Linux kernel oplocks")
 


-- 
Samba Shared Repository


From metze at samba.org  Sat Dec  5 22:36:02 2020
From: metze at samba.org (Stefan Metzmacher)
Date: Sat, 05 Dec 2020 22:36:02 +0000
Subject: [SCM] Samba Shared Repository - branch master updated
Message-ID: <E1klg9q-0052b8-1h@hrx0.samba.org>

The branch, master has been updated
       via  ed21259358e WHATSNEW.txt: fix version to 4.14
      from  bbd94522b1e smbd: Remove "have_share_modes" from "struct share_mode_data"

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit ed21259358e43594b655debb30dfc0e70aa9ed40
Author: Stefan Metzmacher <metze at samba.org>
Date:   Sat Dec 5 22:19:07 2020 +0100

    WHATSNEW.txt: fix version to 4.14
    
    Signed-off-by: Stefan Metzmacher <metze at samba.org>
    
    Autobuild-User(master): Stefan Metzmacher <metze at samba.org>
    Autobuild-Date(master): Sat Dec  5 22:35:04 UTC 2020 on sn-devel-184

-----------------------------------------------------------------------

Summary of changes:
 WHATSNEW.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)


Changeset truncated at 500 lines:

diff --git a/WHATSNEW.txt b/WHATSNEW.txt
index 7651b0af564..9cfd2840b17 100644
--- a/WHATSNEW.txt
+++ b/WHATSNEW.txt
@@ -6,7 +6,7 @@ intended for production environments and is designed for testing
 purposes only.  Please report any defects via the Samba bug reporting
 system at https://bugzilla.samba.org/.
 
-Samba 4.13 will be the next version of the Samba suite.
+Samba 4.14 will be the next version of the Samba suite.
 
 
 UPGRADING


-- 
Samba Shared Repository


From jra at samba.org  Mon Dec  7 18:55:01 2020
From: jra at samba.org (Jeremy Allison)
Date: Mon, 07 Dec 2020 18:55:01 +0000
Subject: [SCM] Samba Shared Repository - branch master updated
Message-ID: <E1kmLf3-007G3I-NC@hrx0.samba.org>

The branch, master has been updated
       via  058f96f4c4e s4/samba: call force_check_log_size() in standard_new_task()
       via  6fa5fb8ef26 s4/samba: call force_check_log_size() in standard_accept_connection()
       via  82b64e930b0 s4/samba: call force_check_log_size() in prefork_reload_after_fork()
       via  19413e76a46 s4: call reopen_logs_internal() in the SIGHUP handler of the prefork process model
       via  9f71e6173ab s4: replace low-level SIGUP handler with a tevent handler
       via  516c2a04a24 s4: install tevent tracing hooks to trigger logfile rotation
       via  68f71f227b1 s4: add samba server tevent trace helper stuff
       via  3651a51e93b debug: detect logrotation by checking inode number
       via  b7ee3614645 debug: pass struct debug_class *config to do_one_check_log_size()
       via  29cd139a32d debug: pass struct debug_class *config to reopen_one_log()
       via  ab2c712c016 loadparm: setup debug subsystem setting max_log_size from config
      from  ed21259358e WHATSNEW.txt: fix version to 4.14

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 058f96f4c4eda42b404f0067521d3eafb495fe7d
Author: Ralph Boehme <slow at samba.org>
Date:   Thu Nov 26 15:24:44 2020 +0100

    s4/samba: call force_check_log_size() in standard_new_task()
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14248
    RN: samba process does not honor max log size
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>
    
    Autobuild-User(master): Jeremy Allison <jra at samba.org>
    Autobuild-Date(master): Mon Dec  7 18:54:29 UTC 2020 on sn-devel-184

commit 6fa5fb8ef26dab862df5c46bb5e74f19839c30e2
Author: Ralph Boehme <slow at samba.org>
Date:   Thu Nov 26 15:24:26 2020 +0100

    s4/samba: call force_check_log_size() in standard_accept_connection()
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14248
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 82b64e930b0e2d3b2e5186017d9f8e420994136c
Author: Ralph Boehme <slow at samba.org>
Date:   Thu Nov 26 15:23:58 2020 +0100

    s4/samba: call force_check_log_size() in prefork_reload_after_fork()
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14248
    
    Signed-off-by: Ralph Boehme <slow at samba.org>

commit 19413e76a46f07fdd46fde5e60707bb6845a782d
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Nov 23 16:44:04 2020 +0100

    s4: call reopen_logs_internal() in the SIGHUP handler of the prefork process model
    
    With debug_schedule_reopen_logs() the actual reopen only takes place at some
    point in the future when a DEBUG message is processed.
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14248
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 9f71e6173ab43a04804ba8061cb0e8ae6c0165bf
Author: Ralph Boehme <slow at samba.org>
Date:   Fri Nov 20 15:21:03 2020 +0100

    s4: replace low-level SIGUP handler with a tevent handler
    
    Replace the low-level signal handler for SIGHUP with a nice tevent signal
    handler. The low-level handler sig_hup() installed by setup_signals() remains
    being used during early startup before a tevent context is available.
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14248
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 516c2a04a242a539f9fbddb2822295fee233644c
Author: Ralph Boehme <slow at samba.org>
Date:   Thu Nov 26 14:21:58 2020 +0100

    s4: install tevent tracing hooks to trigger logfile rotation
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14248
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 68f71f227b17774a12c84575c1eecd82279fac95
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Nov 23 17:53:57 2020 +0100

    s4: add samba server tevent trace helper stuff
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14248
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 3651a51e93b45104323d5db1d5ea704d4f71acf1
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Nov 23 16:04:03 2020 +0100

    debug: detect logrotation by checking inode number
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14248
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit b7ee36146458bcc2c944f5670b7632df8281ae61
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Nov 23 15:51:09 2020 +0100

    debug: pass struct debug_class *config to do_one_check_log_size()
    
    Pass a pointer to the struct instead of all struct members individually. No
    change in behaviour.
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14248
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 29cd139a32d5dbf36bef68eb9c7f1160201e3042
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Nov 23 15:46:47 2020 +0100

    debug: pass struct debug_class *config to reopen_one_log()
    
    Pass a pointer to the struct instead of all struct members individually. No
    change in behaviour.
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14248
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit ab2c712c016f4e4dacd5064b9eb8f6417f4b9b60
Author: Ralph Boehme <slow at samba.org>
Date:   Fri Nov 13 12:34:50 2020 +0100

    loadparm: setup debug subsystem setting max_log_size from config
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14248
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

-----------------------------------------------------------------------

Summary of changes:
 lib/param/loadparm.c                               |  1 +
 lib/util/debug.c                                   | 63 ++++++++++-----
 source4/samba/process_prefork.c                    | 16 +++-
 source4/samba/process_standard.c                   |  4 +
 source4/samba/server.c                             | 46 +++++++++++
 source4/samba/server_util.c                        | 94 ++++++++++++++++++++++
 .../winbindd_ads.h => source4/samba/server_util.h  | 18 ++---
 source4/samba/wscript_build                        |  9 ++-
 8 files changed, 219 insertions(+), 32 deletions(-)
 create mode 100644 source4/samba/server_util.c
 copy source3/winbindd/winbindd_ads.h => source4/samba/server_util.h (67%)


Changeset truncated at 500 lines:

diff --git a/lib/param/loadparm.c b/lib/param/loadparm.c
index eaf992f209b..3548c47d857 100644
--- a/lib/param/loadparm.c
+++ b/lib/param/loadparm.c
@@ -3201,6 +3201,7 @@ static bool lpcfg_update(struct loadparm_context *lp_ctx)
 	settings.debug_pid = lp_ctx->globals->debug_pid;
 	settings.debug_uid = lp_ctx->globals->debug_uid;
 	settings.debug_class = lp_ctx->globals->debug_class;
+	settings.max_log_size = lp_ctx->globals->max_log_size;
 	debug_set_settings(&settings, lp_ctx->globals->logging,
 			   lp_ctx->globals->syslog,
 			   lp_ctx->globals->syslog_only);
diff --git a/lib/util/debug.c b/lib/util/debug.c
index 402345222e5..18e5b4f6c72 100644
--- a/lib/util/debug.c
+++ b/lib/util/debug.c
@@ -113,6 +113,8 @@ struct debug_class {
 	 */
 	char *logfile;
 	int fd;
+	/* inode number of the logfile to detect logfile rotation */
+	ino_t ino;
 };
 
 static const char *default_classname_table[] = {
@@ -1082,14 +1084,17 @@ static void debug_callback_log(const char *msg, int msg_level)
  Fix from dgibson at linuxcare.com.
 **************************************************************************/
 
-static bool reopen_one_log(int *fd, const char *logfile)
+static bool reopen_one_log(struct debug_class *config)
 {
-	int old_fd = *fd;
+	int old_fd = config->fd;
+	const char *logfile = config->logfile;
+	struct stat st;
 	int new_fd;
+	int ret;
 
 	if (logfile == NULL) {
 		debug_close_fd(old_fd);
-		*fd = -1;
+		config->fd = -1;
 		return true;
 	}
 
@@ -1104,8 +1109,18 @@ static bool reopen_one_log(int *fd, const char *logfile)
 
 	debug_close_fd(old_fd);
 	smb_set_close_on_exec(new_fd);
-	*fd = new_fd;
+	config->fd = new_fd;
 
+	ret = fstat(new_fd, &st);
+	if (ret != 0) {
+		log_overflow = true;
+		DBG_ERR("Unable to fstat() new log file '%s': %s\n",
+			logfile, strerror(errno));
+		log_overflow = false;
+		return false;
+	}
+
+	config->ino = st.st_ino;
 	return true;
 }
 
@@ -1164,8 +1179,7 @@ bool reopen_logs_internal(void)
 	state.reopening_logs = true;
 
 	for (i = DBGC_ALL; i < debug_num_classes; i++) {
-		ok = reopen_one_log(&dbgc_config[i].fd,
-				    dbgc_config[i].logfile);
+		ok = reopen_one_log(&dbgc_config[i]);
 		if (!ok) {
 			break;
 		}
@@ -1249,51 +1263,62 @@ bool need_to_check_log_size(void)
  Check to see if the log has grown to be too big.
  **************************************************************************/
 
-static void do_one_check_log_size(off_t maxlog, int *_fd, const char *logfile)
+static void do_one_check_log_size(off_t maxlog, struct debug_class *config)
 {
-	char name[strlen(logfile) + 5];
+	char name[strlen(config->logfile) + 5];
 	struct stat st;
-	int fd = *_fd;
 	int ret;
+	bool reopen = false;
 	bool ok;
 
 	if (maxlog == 0) {
 		return;
 	}
 
-	ret = fstat(fd, &st);
+	ret = stat(config->logfile, &st);
 	if (ret != 0) {
 		return;
 	}
-	if (st.st_size < maxlog ) {
+	if (st.st_size >= maxlog ) {
+		reopen = true;
+	}
+
+	if (st.st_ino != config->ino) {
+		reopen = true;
+	}
+
+	if (!reopen) {
 		return;
 	}
 
 	/* reopen_logs_internal() modifies *_fd */
 	(void)reopen_logs_internal();
-	fd = *_fd;
 
-	if (fd <= 2) {
+	if (config->fd <= 2) {
 		return;
 	}
-	ret = fstat(fd, &st);
+	ret = fstat(config->fd, &st);
 	if (ret != 0) {
+		config->ino = (ino_t)0;
 		return;
 	}
+
+	config->ino = st.st_ino;
+
 	if (st.st_size < maxlog) {
 		return;
 	}
 
-	snprintf(name, sizeof(name), "%s.old", logfile);
+	snprintf(name, sizeof(name), "%s.old", config->logfile);
 
-	(void)rename(logfile, name);
+	(void)rename(config->logfile, name);
 
 	ok = reopen_logs_internal();
 	if (ok) {
 		return;
 	}
 	/* We failed to reopen a log - continue using the old name. */
-	(void)rename(name, logfile);
+	(void)rename(name, config->logfile);
 }
 
 static void do_check_log_size(off_t maxlog)
@@ -1307,9 +1332,7 @@ static void do_check_log_size(off_t maxlog)
 		if (dbgc_config[i].logfile == NULL) {
 			continue;
 		}
-		do_one_check_log_size(maxlog,
-				      &dbgc_config[i].fd,
-				      dbgc_config[i].logfile);
+		do_one_check_log_size(maxlog, &dbgc_config[i]);
 	}
 }
 
diff --git a/source4/samba/process_prefork.c b/source4/samba/process_prefork.c
index f3387d87e61..6a2e3a0acfe 100644
--- a/source4/samba/process_prefork.c
+++ b/source4/samba/process_prefork.c
@@ -45,6 +45,7 @@
 #include "lib/util/tfork.h"
 #include "lib/messaging/irpc.h"
 #include "lib/util/util_process.h"
+#include "server_util.h"
 
 #define min(a, b) (((a) < (b)) ? (a) : (b))
 
@@ -114,7 +115,7 @@ static void sighup_signal_handler(struct tevent_context *ev,
 				int signum, int count, void *siginfo,
 				void *private_data)
 {
-	debug_schedule_reopen_logs();
+	reopen_logs_internal();
 }
 
 static void sigterm_signal_handler(struct tevent_context *ev,
@@ -154,6 +155,7 @@ static void prefork_reload_after_fork(void)
 	if (!NT_STATUS_IS_OK(status)) {
 		smb_panic("Failed to re-initialise imessaging after fork");
 	}
+	force_check_log_size();
 }
 
 /*
@@ -244,6 +246,7 @@ static void prefork_fork_master(
 	struct tevent_context *ev2;
 	struct task_server *task = NULL;
 	struct process_details pd = initial_process_details;
+	struct samba_tevent_trace_state *samba_tevent_trace_state = NULL;
 	int control_pipe[2];
 
 	t = tfork_create();
@@ -327,6 +330,17 @@ static void prefork_fork_master(
 	 */
 	ev2 = s4_event_context_init(NULL);
 
+	samba_tevent_trace_state = create_samba_tevent_trace_state(ev2);
+	if (samba_tevent_trace_state == NULL) {
+		TALLOC_FREE(ev);
+		TALLOC_FREE(ev2);
+		exit(127);
+	}
+
+	tevent_set_trace_callback(ev2,
+				  samba_tevent_trace_callback,
+				  samba_tevent_trace_state);
+
 	/* setup this new connection: process will bind to it's sockets etc
 	 *
 	 * While we can use ev for the child, which has been re-initialised
diff --git a/source4/samba/process_standard.c b/source4/samba/process_standard.c
index 2820e30eace..396054dbc9d 100644
--- a/source4/samba/process_standard.c
+++ b/source4/samba/process_standard.c
@@ -408,6 +408,8 @@ static void standard_accept_connection(
 	talloc_free(c);
 	talloc_free(s);
 
+	force_check_log_size();
+
 	/* setup this new connection.  Cluster ID is PID based for this process model */
 	new_conn(ev, lp_ctx, sock2, cluster_id(pid, 0), private_data,
 		 process_context);
@@ -514,6 +516,8 @@ static void standard_new_task(struct tevent_context *ev,
 	 */
 	prctl_set_comment("%s[task]", service_name);
 
+	force_check_log_size();
+
 	/*
 	 * Set up the process context to be passed through to the terminate
 	 * and accept_connection functions
diff --git a/source4/samba/server.c b/source4/samba/server.c
index d3cbd654d76..6e07f048c0f 100644
--- a/source4/samba/server.c
+++ b/source4/samba/server.c
@@ -46,6 +46,7 @@
 #include "lib/util/tfork.h"
 #include "dsdb/samdb/ldb_modules/util.h"
 #include "lib/util/server_id.h"
+#include "server_util.h"
 
 #ifdef HAVE_PTHREAD
 #include <pthread.h>
@@ -154,6 +155,19 @@ static void sigterm_signal_handler(struct tevent_context *ev,
 	sig_term(SIGTERM);
 }
 
+static void sighup_signal_handler(struct tevent_context *ev,
+				  struct tevent_signal *se,
+				  int signum, int count, void *siginfo,
+				  void *private_data)
+{
+	struct server_state *state = talloc_get_type_abort(
+                private_data, struct server_state);
+
+	DBG_DEBUG("Process %s got SIGHUP\n", state->binary_name);
+
+	reopen_logs_internal();
+}
+
 /*
   setup signal masks
 */
@@ -572,6 +586,7 @@ static int binary_smbd_main(const char *binary_name,
 	};
 	struct server_state *state = NULL;
 	struct tevent_signal *se = NULL;
+	struct samba_tevent_trace_state *samba_tevent_trace_state = NULL;
 
 	setproctitle("root process");
 
@@ -729,6 +744,21 @@ static int binary_smbd_main(const char *binary_name,
 
 	talloc_set_destructor(state->event_ctx, event_ctx_destructor);
 
+	samba_tevent_trace_state = create_samba_tevent_trace_state(state);
+	if (samba_tevent_trace_state == NULL) {
+		exit_daemon("Samba failed to setup tevent tracing state",
+			    ENOTTY);
+		/*
+		 * return is never reached but is here to satisfy static
+		 * checkers
+		 */
+		return 1;
+	}
+
+	tevent_set_trace_callback(state->event_ctx,
+				  samba_tevent_trace_callback,
+				  samba_tevent_trace_state);
+
 	if (opt_interactive) {
 		/* terminate when stdin goes away */
 		stdin_event_flags = TEVENT_FD_READ;
@@ -817,6 +847,22 @@ static int binary_smbd_main(const char *binary_name,
 		return 1;
 	}
 
+	se = tevent_add_signal(state->event_ctx,
+				state->event_ctx,
+				SIGHUP,
+				0,
+				sighup_signal_handler,
+				state);
+	if (se == NULL) {
+		TALLOC_FREE(state);
+		exit_daemon("Initialize SIGHUP handler failed", ENOMEM);
+		/*
+		 * return is never reached but is here to satisfy static
+		 * checkers
+		 */
+		return 1;
+	}
+
 	if (lpcfg_server_role(cmdline_lp_ctx) != ROLE_ACTIVE_DIRECTORY_DC
 	    && !lpcfg_parm_bool(cmdline_lp_ctx, NULL,
 			"server role check", "inhibit", false)
diff --git a/source4/samba/server_util.c b/source4/samba/server_util.c
new file mode 100644
index 00000000000..282ad9b17cd
--- /dev/null
+++ b/source4/samba/server_util.c
@@ -0,0 +1,94 @@
+/*
+   Unix SMB/CIFS implementation.
+
+   Utility routines
+
+   Copyright (C) 2020 Ralph Boehme <slow at samba.org>
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "includes.h"
+#include "lib/tevent/tevent.h"
+#include "lib/util/unix_privs.h"
+#include "server_util.h"
+
+struct samba_tevent_trace_state {
+	size_t events;
+	time_t last_logsize_check;
+};
+
+struct samba_tevent_trace_state *create_samba_tevent_trace_state(
+	TALLOC_CTX *mem_ctx)
+{
+	return talloc_zero(mem_ctx, struct samba_tevent_trace_state);
+}
+
+void samba_tevent_trace_callback(enum tevent_trace_point point,
+				 void *private_data)
+{
+	struct samba_tevent_trace_state *state =
+		talloc_get_type_abort(private_data,
+				      struct samba_tevent_trace_state);
+	time_t now = time(NULL);
+	bool do_check_logs = false;
+	void *priv = NULL;
+
+	switch (point) {
+	case TEVENT_TRACE_BEFORE_WAIT:
+		break;
+	default:
+		return;
+	}
+
+	state->events++;
+
+	/*
+	 * Throttling by some random numbers. smbd uses a similar logic
+	 * checking every 50 SMB requests. Assuming 4 events per request
+	 * we get to the number of 200.
+	 */
+	if ((state->events % 200) == 0) {
+		do_check_logs = true;
+	}
+	/*
+	 * Throttling by some delay, choosing 29 to avoid lockstep with
+	 * the default tevent tickle timer.
+	 */
+	if ((state->last_logsize_check + 29) < now) {
+		do_check_logs = true;
+	}
+
+	if (!do_check_logs) {
+		return;
+	}
+
+	/*
+	 * need_to_check_log_size() checks both the number of messages
+	 * that have been logged and if the logging backend is actually
+	 * going to file. We want to bypass the "number of messages"
+	 * check, so we have to call force_check_log_size() before.
+	 */
+	force_check_log_size();
+	if (!need_to_check_log_size()) {
+		return;
+	}
+
+	priv = root_privileges();
+	check_log_size();
+	TALLOC_FREE(priv);
+
+	state->last_logsize_check = now;
+	return;
+}
diff --git a/source3/winbindd/winbindd_ads.h b/source4/samba/server_util.h
similarity index 67%
copy from source3/winbindd/winbindd_ads.h
copy to source4/samba/server_util.h
index 5f121c89e8f..08c09cc67c2 100644
--- a/source3/winbindd/winbindd_ads.h
+++ b/source4/samba/server_util.h
@@ -1,9 +1,9 @@
 /*
    Unix SMB/CIFS implementation.
 
-   Winbind ADS backend functions
+   Utility routines
 
-   Copyright (C) Volker Lendecke 2017
+   Copyright (C) 2020 Ralph Boehme <slow at samba.org>
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -19,15 +19,15 @@
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 
-#ifndef __WINBINDD_ADS_H__
-#define __WINBINDD_ADS_H__
+#ifndef SAMBA_SERVER_UTIL_H
+#define SAMBA_SERVER_UTIL_H
 
+struct samba_tevent_trace_state;
 
-#include "ads.h"
+struct samba_tevent_trace_state *create_samba_tevent_trace_state(
+	TALLOC_CTX *mem_ctx);
 
-extern struct winbindd_methods ads_methods;
-
-ADS_STATUS ads_idmap_cached_connection(ADS_STRUCT **adsp,
-				       const char *dom_name);
+void samba_tevent_trace_callback(enum tevent_trace_point point,
+				 void *private_data);
 
 #endif
diff --git a/source4/samba/wscript_build b/source4/samba/wscript_build
index ef0aaf773c1..14267c1c9a5 100644
--- a/source4/samba/wscript_build
+++ b/source4/samba/wscript_build
@@ -17,11 +17,16 @@ bld.SAMBA_LIBRARY('process_model',
                   enabled=bld.AD_DC_BUILD_IS_ENABLED()
                   )
 
+bld.SAMBA_SUBSYSTEM('samba_server_util',
+	            source='server_util.c',
+                    deps='samba-util')
+
 bld.SAMBA_BINARY('samba',
 	source='server.c',
 	subsystem_name='service',
 	deps='''events process_model service samba-hostconfig samba-util POPT_SAMBA
-                popt gensec registry ntvfs share cluster COMMON_SCHANNEL SECRETS''',
+                popt gensec registry ntvfs share cluster COMMON_SCHANNEL SECRETS
+                samba_server_util''',
 	pyembed=True,
 	install_path='${SBINDIR}',
 	enabled=bld.AD_DC_BUILD_IS_ENABLED()
@@ -48,6 +53,6 @@ bld.SAMBA_MODULE('process_model_prefork',
                  source='process_prefork.c',
                  subsystem='process_model',
                  init_function='process_model_prefork_init',
-                 deps='MESSAGING events ldbsamba cluster samba-sockets process_model messages_dgm',
+                 deps='MESSAGING events ldbsamba cluster samba-sockets process_model messages_dgm samba_server_util',
                  internal_module=False
                  )


-- 
Samba Shared Repository


From jra at samba.org  Mon Dec  7 20:08:01 2020
From: jra at samba.org (Jeremy Allison)
Date: Mon, 07 Dec 2020 20:08:01 +0000
Subject: [SCM] Samba Shared Repository - branch master updated
Message-ID: <E1kmMnh-00CJLG-R0@hrx0.samba.org>

The branch, master has been updated
       via  14768d0d544 s4:torture:smb2: remove unused fallback defines in oplock.c
       via  30c1c153650 s3:smbd: remove unused fallback defines in oplock_linux.c
       via  6d4ce53ecdc s3/wscript: only check for F_SETLEASE being available at compile time
       via  1b2e67641f2 s3/wscript: remove unused check for F_NOTIFY
      from  058f96f4c4e s4/samba: call force_check_log_size() in standard_new_task()

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 14768d0d54420fe19d914fe4e507cbbf5cb84434
Author: Stefan Metzmacher <metze at samba.org>
Date:   Mon Dec 7 12:06:11 2020 +0100

    s4:torture:smb2: remove unused fallback defines in oplock.c
    
    F_SETLEASE/F_SETSIG were all included in the kernel
    and glibc in 2002, there's no need to have fallbacks 18 years later.
    
    Signed-off-by: Stefan Metzmacher <metze at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>
    
    Autobuild-User(master): Jeremy Allison <jra at samba.org>
    Autobuild-Date(master): Mon Dec  7 20:07:18 UTC 2020 on sn-devel-184

commit 30c1c153650ec23860b59bbcd86bb8e6a1460c42
Author: Stefan Metzmacher <metze at samba.org>
Date:   Mon Dec 7 12:06:11 2020 +0100

    s3:smbd: remove unused fallback defines in oplock_linux.c
    
    F_GETLEASE/F_SETLEASE/F_SETSIG were all included in the kernel
    and glibc in 2002, there's no need to have fallbacks 18 years later.
    
    Signed-off-by: Stefan Metzmacher <metze at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 6d4ce53ecdc92cd9693b8e63166ec672209b7268
Author: Stefan Metzmacher <metze at samba.org>
Date:   Mon Dec 7 11:38:59 2020 +0100

    s3/wscript: only check for F_SETLEASE being available at compile time
    
    F_GETLEASE/F_SETLEASE are available (at least) since Linux 2.4.0 from
    2002.
    
    We also should not have the configure check depend on the filesystem
    we find at build time. It's very common that the build-environment is
    much more restricted than the runtime-environment will be.
    
    As a history we had this check on Samba 3.6:
    
     AC_CACHE_CHECK([for Linux kernel oplocks],samba_cv_HAVE_KERNEL_OPLOCKS_LINUX,[
     AC_TRY_RUN([
     #include <sys/types.h>
     #include <fcntl.h>
     #ifndef F_GETLEASE
     #define F_GETLEASE	1025
     #endif
     main() {
            int fd = open("/dev/null", O_RDONLY);
            return fcntl(fd, F_GETLEASE, 0) == -1;
     }
     ],
     samba_cv_HAVE_KERNEL_OPLOCKS_LINUX=yes,samba_cv_HAVE_KERNEL_OPLOCKS_LINUX=no,samba_cv_HAVE_KERNEL_OPLOCKS_LINUX=cross)])
     if test x"$samba_cv_HAVE_KERNEL_OPLOCKS_LINUX" = x"yes"; then
        AC_DEFINE(HAVE_KERNEL_OPLOCKS_LINUX,1,[Whether to use linux kernel oplocks])
     fi
    
    which didn't depend on the filesystem.
    
    Then we got a broken check introduced in Samba 4.0 (a copy of the
    F_NOTIFY check):
    
     # Check for Linux kernel oplocks
     conf.CHECK_CODE('''
     #include <sys/types.h>
     #include <fcntl.h>
     #include <signal.h>
     #ifndef F_NOTIFY
     #define F_NOTIFY 1026
     #endif
     main() {
             exit(fcntl(open("/tmp", O_RDONLY), F_NOTIFY, 0) == -1 ?  1 : 0);
     }''', 'HAVE_KERNEL_OPLOCKS_LINUX', addmain=False, execute=True,
            msg="Checking for Linux kernel oplocks")
    
    this got "fixed" in Samba 4.7 (and backports to 4.6, 4.5 and 4.4) into
    
     # Check for Linux kernel oplocks
     conf.CHECK_CODE('''
     #include <sys/types.h>
     #include <fcntl.h>
     #include <signal.h>
     #ifndef F_GETLEASE
     #define F_GETLEASE 1025
     #endif
     main() {
             exit(fcntl(open("/tmp", O_RDONLY), F_GETLEASE, 0) == -1 ?  1 : 0);
     }''', 'HAVE_KERNEL_OPLOCKS_LINUX', addmain=False, execute=True,
            msg="Checking for Linux kernel oplocks")
    
    Lately it became dependend on the filesystem in the build-environment:
    
     # Check for Linux kernel oplocks
     conf.CHECK_CODE('''
     #include <sys/types.h>
     #include <fcntl.h>
     #include <signal.h>
     #ifndef F_GETLEASE
     #define F_GETLEASE 1025
     #endif
     main() {
           const char *fname="/tmp/oplock-test.txt";
           int fd = open(fname, O_RDWR|O_CREAT, 0644);
           int ret = fcntl(fd, F_SETLEASE, F_WRLCK);
           unlink(fname);
           return (ret == -1) ? 1 : 0;
     }''', 'HAVE_KERNEL_OPLOCKS_LINUX', addmain=False, execute=True,
            msg="Checking for Linux kernel oplocks")
    
    Now we just check for F_SETLEASE being available in linux/fcntl.h.
    
    Signed-off-by: Stefan Metzmacher <metze at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 1b2e67641f2df766d099696a11e7b5122f5851cf
Author: Stefan Metzmacher <metze at samba.org>
Date:   Mon Dec 7 11:24:43 2020 +0100

    s3/wscript: remove unused check for F_NOTIFY
    
    There're no references to F_NOTIFY nor HAVE_KERNEL_CHANGE_NOTIFY in the
    code, so the configure check is not needed at all.
    
    We only use the inotify or fam abstractions.
    
    Signed-off-by: Stefan Metzmacher <metze at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

-----------------------------------------------------------------------

Summary of changes:
 source3/smbd/oplock_linux.c            | 12 ------------
 source3/wscript                        | 28 ++--------------------------
 source4/ntvfs/sysdep/wscript_configure |  1 -
 source4/torture/smb2/oplock.c          |  8 --------
 4 files changed, 2 insertions(+), 47 deletions(-)


Changeset truncated at 500 lines:

diff --git a/source3/smbd/oplock_linux.c b/source3/smbd/oplock_linux.c
index 44ed976b92c..a4f79297abd 100644
--- a/source3/smbd/oplock_linux.c
+++ b/source3/smbd/oplock_linux.c
@@ -25,22 +25,10 @@
 
 #ifdef HAVE_KERNEL_OPLOCKS_LINUX
 
-#ifndef F_SETLEASE
-#define F_SETLEASE	1024
-#endif
-
-#ifndef F_GETLEASE
-#define F_GETLEASE	1025
-#endif
-
 #ifndef RT_SIGNAL_LEASE
 #define RT_SIGNAL_LEASE (SIGRTMIN+1)
 #endif
 
-#ifndef F_SETSIG
-#define F_SETSIG 10
-#endif
-
 /* 
  * Call to set the kernel lease signal handler
  */
diff --git a/source3/wscript b/source3/wscript
index a370fae667f..ba02a3586b9 100644
--- a/source3/wscript
+++ b/source3/wscript
@@ -165,33 +165,9 @@ long ret = splice(0,0,1,0,400,SPLICE_F_MOVE);
         if conf.env.HAVE_SYS_INOTIFY_H:
            conf.DEFINE('HAVE_INOTIFY', 1)
 
-    # Check for kernel change notify support
-    conf.CHECK_CODE('''
-#ifndef F_NOTIFY
-#define F_NOTIFY 1026
-#endif
-main() {
-        exit(fcntl(open("/tmp", O_RDONLY), F_NOTIFY, 0) == -1 ?  1 : 0);
-}''', 'HAVE_KERNEL_CHANGE_NOTIFY', addmain=False, execute=True,
-        headers='fcntl.h signal.h',
-        msg="Checking for kernel change notify support")
-
     # Check for Linux kernel oplocks
-    conf.CHECK_CODE('''
-#include <sys/types.h>
-#include <fcntl.h>
-#include <signal.h>
-#ifndef F_GETLEASE
-#define F_GETLEASE 1025
-#endif
-int main() {
-	const char *fname="/tmp/oplock-test.txt";
-	int fd = open(fname, O_RDWR|O_CREAT, 0644);
-	int ret = fcntl(fd, F_SETLEASE, F_WRLCK);
-	unlink(fname);
-	return (ret == -1) ? 1 : 0;
-}''', 'HAVE_KERNEL_OPLOCKS_LINUX', addmain=False, execute=True,
-        msg="Checking for Linux kernel oplocks")
+    if conf.CHECK_DECLS('F_SETLEASE', headers='linux/fcntl.h', reverse=True):
+        conf.DEFINE('HAVE_KERNEL_OPLOCKS_LINUX', 1)
 
     # Check for kernel share modes
     conf.CHECK_CODE('''
diff --git a/source4/ntvfs/sysdep/wscript_configure b/source4/ntvfs/sysdep/wscript_configure
index 274fc08b581..20358848cd3 100644
--- a/source4/ntvfs/sysdep/wscript_configure
+++ b/source4/ntvfs/sysdep/wscript_configure
@@ -10,5 +10,4 @@ if host_os.rfind('sunos') == -1:
     if (conf.CONFIG_SET('HAVE_SYS_INOTIFY_H')):
         conf.DEFINE('HAVE_LINUX_INOTIFY', 1)
 
-conf.CHECK_DECLS('F_SETLEASE', headers='linux/fcntl.h', reverse=True)
 conf.CHECK_DECLS('SA_SIGINFO', headers='signal.h', reverse=True)
diff --git a/source4/torture/smb2/oplock.c b/source4/torture/smb2/oplock.c
index a30657ef596..ad9ef625a5a 100644
--- a/source4/torture/smb2/oplock.c
+++ b/source4/torture/smb2/oplock.c
@@ -5079,18 +5079,10 @@ done:
 
 #ifdef HAVE_KERNEL_OPLOCKS_LINUX
 
-#ifndef F_SETLEASE
-#define F_SETLEASE      1024
-#endif
-
 #ifndef RT_SIGNAL_LEASE
 #define RT_SIGNAL_LEASE (SIGRTMIN+1)
 #endif
 
-#ifndef F_SETSIG
-#define F_SETSIG 10
-#endif
-
 static int got_break;
 
 /*


-- 
Samba Shared Repository


From kseeger at samba.org  Tue Dec  8 10:22:02 2020
From: kseeger at samba.org (Karolin Seeger)
Date: Tue, 08 Dec 2020 10:22:02 +0000
Subject: [SCM] Samba Shared Repository - branch v4-13-test updated
Message-ID: <E1kma8A-0043no-2r@hrx0.samba.org>

The branch, v4-13-test has been updated
       via  54d3d3cbf49 s3: smbd: Quiet log messages from usershares for an unknown share.
       via  f7490ec9d94 s3-libads: Pass timeout to open_socket_out in ms
      from  585c49f21f7 vfs_glusterfs: print exact cmdline for disabling write-behind translator

https://git.samba.org/?p=samba.git;a=shortlog;h=v4-13-test


- Log -----------------------------------------------------------------
commit 54d3d3cbf49b660f7e93aa45caa94fa6821c0999
Author: Jeremy Allison <jra at samba.org>
Date:   Wed Dec 2 11:47:02 2020 -0800

    s3: smbd: Quiet log messages from usershares for an unknown share.
    
    No need to log missing shares/sharenames at debug level zero.
    
    Keep the debug level zero for all other usershare problems.
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14590
    
    Signed-off-by: Jeremy Allison <jra at samba.org>
    Reviewed-by: Rowland penny <rpenny at samba.org>
    Reviewed-by: Andrew Bartlett <abartlet at samba.org>
    
    Autobuild-User(master): Jeremy Allison <jra at samba.org>
    Autobuild-Date(master): Fri Dec  4 20:54:06 UTC 2020 on sn-devel-184
    
    (cherry picked from commit 8a0a7359faba642baf55a8f98ff78c0d0884d0f0)
    
    Autobuild-User(v4-13-test): Karolin Seeger <kseeger at samba.org>
    Autobuild-Date(v4-13-test): Tue Dec  8 10:21:11 UTC 2020 on sn-devel-184

commit f7490ec9d94edfc9cdc79e70580b3b226a2022d5
Author: Isaac Boukris <iboukris at gmail.com>
Date:   Tue Jul 14 22:38:06 2020 +0200

    s3-libads: Pass timeout to open_socket_out in ms
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=13124
    
    Signed-off-by: Isaac Boukris <iboukris at samba.org>
    Reviewed-by: Andreas Schneider <asn at samba.org>
    
    Autobuild-User(master): Andreas Schneider <asn at cryptomilk.org>
    Autobuild-Date(master): Thu Jul 16 10:41:40 UTC 2020 on sn-devel-184
    
    (cherry picked from commit d67e9149a612044e247e7a4d78913ecf396c69fc)

-----------------------------------------------------------------------

Summary of changes:
 source3/libads/ldap.c    |  4 +++-
 source3/param/loadparm.c | 10 ++++++++++
 2 files changed, 13 insertions(+), 1 deletion(-)


Changeset truncated at 500 lines:

diff --git a/source3/libads/ldap.c b/source3/libads/ldap.c
index 10ab043f721..ee4628a09a2 100755
--- a/source3/libads/ldap.c
+++ b/source3/libads/ldap.c
@@ -96,9 +96,11 @@ static void gotalarm_sig(int signum)
 	{
 		int fd = -1;
 		NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
+		unsigned timeout_ms = 1000 * to;
 
-		status = open_socket_out(ss, port, to, &fd);
+		status = open_socket_out(ss, port, timeout_ms, &fd);
 		if (!NT_STATUS_IS_OK(status)) {
+			DEBUG(3, ("open_socket_out: failed to open socket\n"));
 			return NULL;
 		}
 
diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c
index 6674485738a..a3abaa2ec67 100644
--- a/source3/param/loadparm.c
+++ b/source3/param/loadparm.c
@@ -3418,6 +3418,11 @@ static int process_usershare_file(const char *dir_name, const char *file_name, i
 	   open and fstat. Ensure this isn't a symlink link. */
 
 	if (sys_lstat(fname, &lsbuf, false) != 0) {
+		if (errno == ENOENT) {
+			/* Unknown share requested. Just ignore. */
+			goto out;
+		}
+		/* Only log messages for meaningful problems. */
 		DEBUG(0,("process_usershare_file: stat of %s failed. %s\n",
 			fname, strerror(errno) ));
 		goto out;
@@ -3623,6 +3628,11 @@ int load_usershare_service(const char *servicename)
 	int max_user_shares = Globals.usershare_max_shares;
 	int snum_template = -1;
 
+	if (servicename[0] == '\0') {
+		/* Invalid service name. */
+		return -1;
+	}
+
 	if (*usersharepath == 0 ||  max_user_shares == 0) {
 		return -1;
 	}


-- 
Samba Shared Repository


From npower at samba.org  Wed Dec  9 17:05:01 2020
From: npower at samba.org (Noel Power)
Date: Wed, 09 Dec 2020 17:05:01 +0000
Subject: [SCM] Samba Shared Repository - branch master updated
Message-ID: <E1kn2th-00DEtN-CF@hrx0.samba.org>

The branch, master has been updated
       via  cc9ff79d86c dbcheck: err_normalise-mismatch_replace: no msg if no error
       via  f1be8813b01 dbcheck: fix doc for err_normalise_mismatch*
       via  c28a3dd6d27 dbcheck: fix doc for do_rename()
       via  17fb635532d dbcheck: remove unused fix_incorrect_deleted_objects flag
       via  0aec5b930d9 dbcheck: improve some duplicate doc strings
       via  99cdb2191e9 dbcheck: drop py2 support from dump_attr_values()
       via  713117401c8 dbcheck: don't try to stringify values list twice
       via  081d12de529 dbcheck: add docstring for err_odd_userParameters
       via  9fabe3aafdb dbcheck: fix documentation for err_doubled_userParameters
       via  c7b39f1cea0 dbcheck: fix documentation and typo for err_utf_userParameters
       via  fa0350374d3 dbcheck: fix documentation for err_base64_userParameters
       via  3afd594273f dbcheck: fix documentation for err_duplicate_values
       via  9938a9f7db3 selftest/subunit: python file modernisation
       via  02c3a66cbec drs_utils: remove unused sendRemoveDsServer()
       via  a8d1a6c59b4 python: remove unused provision.check_install()
       via  e253c45c6d1 samba-tool gpo: use common attr_default
       via  816dee1a132 samba-tool drs: move attr_default to common
       via  2c48e90fad0 samba-tool pso uses common timestamp functions
       via  c8d3547c5fa samba-tool domain: move timestamp functions to common
      from  14768d0d544 s4:torture:smb2: remove unused fallback defines in oplock.c

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit cc9ff79d86c64cc25c5618866c95f308204716dd
Author: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
Date:   Fri Dec 4 11:53:48 2020 +1300

    dbcheck: err_normalise-mismatch_replace: no msg if no error
    
    Signed-off-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
    Reviewed-by: Noel Power <npower at samba.org>
    
    Autobuild-User(master): Noel Power <npower at samba.org>
    Autobuild-Date(master): Wed Dec  9 17:04:23 UTC 2020 on sn-devel-184

commit f1be8813b01227c0c18052b622899026eb4b14d0
Author: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
Date:   Fri Dec 4 11:52:40 2020 +1300

    dbcheck: fix doc for err_normalise_mismatch*
    
    Signed-off-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
    Reviewed-by: Noel Power <npower at samba.org>

commit c28a3dd6d27e60ca84933dac41f0f696eb963b41
Author: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
Date:   Fri Dec 4 11:51:42 2020 +1300

    dbcheck: fix doc for do_rename()
    
    Signed-off-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
    Reviewed-by: Noel Power <npower at samba.org>

commit 17fb635532dffb51a2237f1291d215d94e433146
Author: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
Date:   Fri Dec 4 11:19:50 2020 +1300

    dbcheck: remove unused fix_incorrect_deleted_objects flag
    
    This was introduced in db15993401f927fd2fcea1687c4155dce2272aa8
    but not actually referenced then or since.
    
    Signed-off-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
    Reviewed-by: Noel Power <npower at samba.org>

commit 0aec5b930d9ca278c9045e6b58e4de2b34d8c591
Author: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
Date:   Fri Dec 4 10:15:24 2020 +1300

    dbcheck: improve some duplicate doc strings
    
    Signed-off-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
    Reviewed-by: Noel Power <npower at samba.org>

commit 99cdb2191e9ab633579f4e7951c2da042529b95d
Author: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
Date:   Fri Dec 4 10:10:50 2020 +1300

    dbcheck: drop py2 support from dump_attr_values()
    
    Signed-off-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
    Reviewed-by: Noel Power <npower at samba.org>

commit 713117401c85642dfa9de0772f0a9954a8b8d804
Author: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
Date:   Fri Dec 4 10:12:08 2020 +1300

    dbcheck: don't try to stringify values list twice
    
    dump_attr_values already turns it into a comma separated list.
    
    Signed-off-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
    Reviewed-by: Noel Power <npower at samba.org>

commit 081d12de529ba89e8eb3930dd3e1cbf394783394
Author: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
Date:   Fri Dec 4 12:34:52 2020 +1300

    dbcheck: add docstring for err_odd_userParameters
    
    Signed-off-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
    Reviewed-by: Noel Power <npower at samba.org>

commit 9fabe3aafdb799db31cf222e186b5ac84b1ed024
Author: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
Date:   Fri Dec 4 12:34:22 2020 +1300

    dbcheck: fix documentation for err_doubled_userParameters
    
    Signed-off-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
    Reviewed-by: Noel Power <npower at samba.org>

commit c7b39f1cea0ef4b27c4897d20ca718c5eb195210
Author: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
Date:   Fri Dec 4 12:34:02 2020 +1300

    dbcheck: fix documentation and typo for err_utf_userParameters
    
    pseudo, not psudo.
    
    Signed-off-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
    Reviewed-by: Noel Power <npower at samba.org>

commit fa0350374d3ffdf78e920361315556034730fde8
Author: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
Date:   Fri Dec 4 12:33:27 2020 +1300

    dbcheck: fix documentation for err_base64_userParameters
    
    Signed-off-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
    Reviewed-by: Noel Power <npower at samba.org>

commit 3afd594273f659056f15b6e6a1a45b68824bf113
Author: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
Date:   Fri Dec 4 11:56:00 2020 +1300

    dbcheck: fix documentation for err_duplicate_values
    
    Signed-off-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
    Reviewed-by: Noel Power <npower at samba.org>

commit 9938a9f7db37283a1e3d2c52e1246c573ecd649b
Author: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
Date:   Thu Nov 19 16:44:42 2020 +1300

    selftest/subunit: python file modernisation
    
    Python idioms for iterating over a line and closing it have improved,
    and we should keep up.
    
    Signed-off-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
    Reviewed-by: Noel Power <npower at samba.org>

commit 02c3a66cbec2c670d809b186cacc7d075c16ec54
Author: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
Date:   Thu Nov 19 12:43:01 2020 +1300

    drs_utils: remove unused sendRemoveDsServer()
    
    The only caller of this was `samba-tool domain demote` which stopped
    using it in 2015 with commit f121173cbf46fe64746d73adf40015c43d5c55fc.
    
    Signed-off-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
    Reviewed-by: Noel Power <npower at samba.org>

commit a8d1a6c59b4e43869454a3e3528948613e9b0c61
Author: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
Date:   Thu Nov 19 12:23:45 2020 +1300

    python: remove unused provision.check_install()
    
    Unused for at last 10 years.
    
    Signed-off-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
    Reviewed-by: Noel Power <npower at samba.org>

commit e253c45c6d1cd76da682f72a0903f01bf094c8a1
Author: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
Date:   Thu Nov 19 11:24:47 2020 +1300

    samba-tool gpo: use common attr_default
    
    Signed-off-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
    Reviewed-by: Noel Power <npower at samba.org>

commit 816dee1a132e6b586de8b0123fd8e9572aff4c32
Author: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
Date:   Thu Nov 19 11:24:25 2020 +1300

    samba-tool drs: move attr_default to common
    
    Signed-off-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
    Reviewed-by: Noel Power <npower at samba.org>

commit 2c48e90fad04db6a78fc4dc1f2cb12154db7f711
Author: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
Date:   Thu Nov 19 11:20:35 2020 +1300

    samba-tool pso uses common timestamp functions
    
    Signed-off-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
    Reviewed-by: Noel Power <npower at samba.org>

commit c8d3547c5fa8724198541cb67b60e5c8e212a1ad
Author: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
Date:   Thu Nov 19 11:19:04 2020 +1300

    samba-tool domain: move timestamp functions to common
    
    Other tools use identical functions, and they too can use common.py
    
    Signed-off-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
    Reviewed-by: Noel Power <npower at samba.org>

-----------------------------------------------------------------------

Summary of changes:
 python/samba/dbchecker.py          | 55 ++++++++++++++++++--------------------
 python/samba/drs_utils.py          | 23 ----------------
 python/samba/netcmd/common.py      | 28 +++++++++++++++++++
 python/samba/netcmd/domain.py      | 23 +++-------------
 python/samba/netcmd/drs.py         |  8 +-----
 python/samba/netcmd/gpo.py         |  8 +-----
 python/samba/netcmd/pso.py         | 21 +++------------
 python/samba/provision/__init__.py | 15 -----------
 selftest/subunithelper.py          | 16 +++--------
 9 files changed, 66 insertions(+), 131 deletions(-)


Changeset truncated at 500 lines:

diff --git a/python/samba/dbchecker.py b/python/samba/dbchecker.py
index 339af01cb1b..28b56edaafb 100644
--- a/python/samba/dbchecker.py
+++ b/python/samba/dbchecker.py
@@ -35,25 +35,20 @@ from samba.auth import system_session, admin_session
 from samba.netcmd import CommandError
 from samba.netcmd.fsmo import get_fsmo_roleowner
 
-# vals is a sequence of ldb.bytes objects which are a subclass
-# of 'byte' type in python3 and just a str type in python2, to
-# display as string these need to be converted to string via (str)
-# function in python3 but that may generate a UnicodeDecode error,
-# if so use repr instead.  We need to at least try to get the 'str'
-# value if possible to allow some tests which check the strings
-# outputted to pass, these tests compare attr values logged to stdout
-# against those in various results files.
 
 def dump_attr_values(vals):
-    result = ""
+    """Stringify a value list, using utf-8 if possible (which some tests
+    want), or the python bytes representation otherwise (with leading
+    'b' and escapes like b'\x00').
+    """
+    result = []
     for value in vals:
-        if len(result):
-            result = "," + result
         try:
-            result = result + str(value)
+            result.append(value.decode('utf-8'))
         except UnicodeDecodeError:
-            result = result + repr(value)
-    return result
+            result.append(repr(value))
+    return ','.join(result)
+
 
 class dbcheck(object):
     """check a SAM database for errors"""
@@ -102,7 +97,6 @@ class dbcheck(object):
         self.fix_replmetadata_wrong_attid = False
         self.fix_replmetadata_unsorted_attid = False
         self.fix_deleted_deleted_objects = False
-        self.fix_incorrect_deleted_objects = False
         self.fix_dn = False
         self.fix_base64_userparameters = False
         self.fix_utf8_userparameters = False
@@ -442,7 +436,7 @@ systemFlags: -1946157056%s""" % (dn, guid_suffix),
         return True
 
     def do_rename(self, from_dn, to_rdn, to_base, controls, msg):
-        '''perform a modify with optional verbose output'''
+        '''perform a rename with optional verbose output'''
         if self.verbose:
             self.report("""dn: %s
 changeType: modrdn
@@ -486,7 +480,7 @@ newSuperior: %s""" % (str(from_dn), str(to_rdn), str(to_base)))
             self.report("Removed empty attribute %s" % attrname)
 
     def err_normalise_mismatch(self, dn, attrname, values):
-        '''fix attribute normalisation errors'''
+        '''fix attribute normalisation errors, without altering sort order'''
         self.report("ERROR: Normalisation error for attribute %s in %s" % (attrname, dn))
         mod_list = []
         for val in values:
@@ -517,12 +511,13 @@ newSuperior: %s""" % (str(from_dn), str(to_rdn), str(to_base)))
             self.report("Normalised attribute %s" % attrname)
 
     def err_normalise_mismatch_replace(self, dn, attrname, values):
-        '''fix attribute normalisation errors'''
+        '''fix attribute normalisation and/or sort errors'''
         normalised = self.samdb.dsdb_normalise_attributes(self.samdb_schema, attrname, values)
-        self.report("ERROR: Normalisation error for attribute '%s' in '%s'" % (attrname, dn))
-        self.report("Values/Order of values do/does not match: %s/%s!" % (values, list(normalised)))
         if list(normalised) == values:
+            # how we got here is a mystery.
             return
+        self.report("ERROR: Normalisation error for attribute '%s' in '%s'" % (attrname, dn))
+        self.report("Values/Order of values do/does not match: %s/%s!" % (values, list(normalised)))
         if not self.confirm_all("Fix normalisation for '%s' from '%s'?" % (attrname, dn), 'fix_all_normalisation'):
             self.report("Not fixing attribute '%s'" % attrname)
             return
@@ -537,9 +532,10 @@ newSuperior: %s""" % (str(from_dn), str(to_rdn), str(to_base)))
             self.report("Normalised attribute %s" % attrname)
 
     def err_duplicate_values(self, dn, attrname, dup_values, values):
-        '''fix attribute normalisation errors'''
+        '''fix duplicate attribute values'''
         self.report("ERROR: Duplicate values for attribute '%s' in '%s'" % (attrname, dn))
-        self.report("Values contain a duplicate: [%s]/[%s]!" % (','.join(dump_attr_values(dup_values)), ','.join(dump_attr_values(values))))
+        self.report("Values contain a duplicate: [%s]/[%s]!" %
+                    (dump_attr_values(dup_values), dump_attr_values(values)))
         if not self.confirm_all("Fix duplicates for '%s' from '%s'?" % (attrname, dn), 'fix_all_duplicates'):
             self.report("Not fixing attribute '%s'" % attrname)
             return
@@ -724,7 +720,7 @@ newSuperior: %s""" % (str(from_dn), str(to_rdn), str(to_base)))
             self.report("Fixed %s on attribute %s" % (errstr, attrname))
 
     def err_dn_string_component_old(self, dn, attrname, val, dsdb_dn, correct_dn):
-        """handle a DN string being incorrect"""
+        """handle a DN string being incorrect due to a rename or delete"""
         self.report("NOTE: old (due to rename or delete) DN string component for %s in object %s - %s" % (attrname, dn, val))
         dsdb_dn.dn = correct_dn
 
@@ -759,7 +755,7 @@ newSuperior: %s""" % (str(from_dn), str(to_rdn), str(to_base)))
             self.report("Fixed incorrect DN %s on attribute %s" % (mismatch_type, attrname))
 
     def err_dn_component_missing_target_sid(self, dn, attrname, val, dsdb_dn, target_sid_blob):
-        """handle a DN string being incorrect"""
+        """fix missing <SID=...> on linked attributes"""
         self.report("ERROR: missing DN SID component for %s in object %s - %s" % (attrname, dn, val))
 
         if len(dsdb_dn.prefix) != 0:
@@ -977,7 +973,7 @@ newSuperior: %s""" % (str(from_dn), str(to_rdn), str(to_base)))
         self.report("ERROR: incorrect userParameters value on object %s.  If you have another working DC that does not give this warning, please run 'samba-tool drs replicate --full-sync --local <destinationDC> <sourceDC> %s'" % (obj.dn, self.samdb.get_nc_root(obj.dn)))
 
     def err_base64_userParameters(self, obj, attrname, value):
-        '''handle a wrong userParameters'''
+        '''handle a userParameters that is wrongly base64 encoded'''
         self.report("ERROR: wrongly formatted userParameters %s on %s, should not be base64-encoded" % (value, obj.dn))
         if not self.confirm_all('Convert userParameters from base64 encoding on %s?' % (obj.dn), 'fix_base64_userparameters'):
             self.report('Not changing userParameters from base64 encoding on %s' % (obj.dn))
@@ -991,8 +987,9 @@ newSuperior: %s""" % (str(from_dn), str(to_rdn), str(to_base)))
             self.report("Corrected base64-encoded userParameters on %s by converting from base64" % (obj.dn))
 
     def err_utf8_userParameters(self, obj, attrname, value):
-        '''handle a wrong userParameters'''
-        self.report("ERROR: wrongly formatted userParameters on %s, should not be psudo-UTF8 encoded" % (obj.dn))
+        '''handle a userParameters that is wrongly utf-8 encoded'''
+        self.report("ERROR: wrongly formatted userParameters on %s, "
+                    "should not be pseudo-UTF8 encoded" % (obj.dn))
         if not self.confirm_all('Convert userParameters from UTF8 encoding on %s?' % (obj.dn), 'fix_utf8_userparameters'):
             self.report('Not changing userParameters from UTF8 encoding on %s' % (obj.dn))
             return
@@ -1006,7 +1003,7 @@ newSuperior: %s""" % (str(from_dn), str(to_rdn), str(to_base)))
             self.report("Corrected psudo-UTF8 encoded userParameters on %s by converting from UTF8" % (obj.dn))
 
     def err_doubled_userParameters(self, obj, attrname, value):
-        '''handle a wrong userParameters'''
+        '''handle a userParameters that has been utf-16 encoded twice'''
         self.report("ERROR: wrongly formatted userParameters on %s, should not be double UTF16 encoded" % (obj.dn))
         if not self.confirm_all('Convert userParameters from doubled UTF-16 encoding on %s?' % (obj.dn), 'fix_doubled_userparameters'):
             self.report('Not changing userParameters from doubled UTF-16 encoding on %s' % (obj.dn))
@@ -1032,7 +1029,7 @@ newSuperior: %s""" % (str(from_dn), str(to_rdn), str(to_base)))
             self.report("Corrected doubled-UTF16 encoded userParameters on %s by converting" % (obj.dn))
 
     def err_odd_userParameters(self, obj, attrname):
-        # This is a truncated userParameters due to a pre 4.1 replication bug
+        """Fix a truncated userParameters due to a pre 4.1 replication bug"""
         self.report("ERROR: incorrect userParameters value on object %s (odd length).  If you have another working DC that does not give this warning, please run 'samba-tool drs replicate --full-sync --local <destinationDC> <sourceDC> %s'" % (obj.dn, self.samdb.get_nc_root(obj.dn)))
 
     def find_revealed_link(self, dn, attrname, guid):
diff --git a/python/samba/drs_utils.py b/python/samba/drs_utils.py
index 43d1b4a2488..feab89b0d8e 100644
--- a/python/samba/drs_utils.py
+++ b/python/samba/drs_utils.py
@@ -92,29 +92,6 @@ def sendDsReplicaSync(drsuapiBind, drsuapi_handle, source_dsa_guid,
         raise drsException("DsReplicaSync failed %s" % estr)
 
 
-def sendRemoveDsServer(drsuapiBind, drsuapi_handle, server_dsa_dn, domain):
-    """Send RemoveDSServer request.
-
-    :param drsuapiBind: a drsuapi Bind object
-    :param drsuapi_handle: a drsuapi handle on the drsuapi connection
-    :param server_dsa_dn: a DN object of the server's dsa that we want to
-        demote
-    :param domain: a DN object of the server's domain
-    :raise drsException: if any error occur while sending and receiving the
-        reply for the DsRemoveDSServer
-    """
-
-    try:
-        req1 = drsuapi.DsRemoveDSServerRequest1()
-        req1.server_dn = str(server_dsa_dn)
-        req1.domain_dn = str(domain)
-        req1.commit = 1
-
-        drsuapiBind.DsRemoveDSServer(drsuapi_handle, 1, req1)
-    except Exception as estr:
-        raise drsException("DsRemoveDSServer failed %s" % estr)
-
-
 def drs_DsBind(drs):
     '''make a DsBind call, returning the binding handle'''
     bind_info = drsuapi.DsBindInfoCtr()
diff --git a/python/samba/netcmd/common.py b/python/samba/netcmd/common.py
index f53ff4555a9..bb17bfa10f2 100644
--- a/python/samba/netcmd/common.py
+++ b/python/samba/netcmd/common.py
@@ -22,6 +22,11 @@ from samba.dcerpc import nbt
 from samba.net import Net
 import ldb
 
+
+# In MS AD, setting a timeout to '(never)' corresponds to this value
+NEVER_TIMESTAMP = int(-0x8000000000000000)
+
+
 def _get_user_realm_domain(user):
     r""" get the realm or the domain and the base user
         from user like:
@@ -112,3 +117,26 @@ def get_ldif_for_editor(samdb, msg):
     result_ldif = samdb.write_ldif(m, ldb.CHANGETYPE_NONE)
 
     return result_ldif
+
+
+def timestamp_to_mins(timestamp_str):
+    """Converts a timestamp in -100 nanosecond units to minutes"""
+    # treat a timestamp of 'never' the same as zero (this should work OK for
+    # most settings, and it displays better than trying to convert
+    # -0x8000000000000000 to minutes)
+    if int(timestamp_str) == NEVER_TIMESTAMP:
+        return 0
+    else:
+        return abs(int(timestamp_str)) / (1e7 * 60)
+
+
+def timestamp_to_days(timestamp_str):
+    """Converts a timestamp in -100 nanosecond units to days"""
+    return timestamp_to_mins(timestamp_str) / (60 * 24)
+
+
+def attr_default(msg, attrname, default):
+    '''get an attribute from a ldap msg with a default'''
+    if attrname in msg:
+        return msg[attrname][0]
+    return default
diff --git a/python/samba/netcmd/domain.py b/python/samba/netcmd/domain.py
index 71dacf67a89..6a02b2ecac0 100644
--- a/python/samba/netcmd/domain.py
+++ b/python/samba/netcmd/domain.py
@@ -62,6 +62,9 @@ from samba.netcmd import (
 )
 from samba.netcmd.fsmo import get_fsmo_roleowner
 from samba.netcmd.common import netcmd_get_domain_infos_via_cldap
+from samba.netcmd.common import (NEVER_TIMESTAMP,
+                                 timestamp_to_mins,
+                                 timestamp_to_days)
 from samba.samba3 import Samba3
 from samba.samba3 import param as s3param
 from samba.upgrade import upgrade_from_samba3
@@ -1210,26 +1213,6 @@ class cmd_domain_level(Command):
             raise CommandError("invalid argument: '%s' (choose from 'show', 'raise')" % subcommand)
 
 
-# In MS AD, setting a timeout to '(never)' corresponds to this value
-NEVER_TIMESTAMP = int(-0x8000000000000000)
-
-
-def timestamp_to_mins(timestamp_str):
-    """Converts a timestamp in -100 nanosecond units to minutes"""
-    # treat a timestamp of 'never' the same as zero (this should work OK for
-    # most settings, and it displays better than trying to convert
-    # -0x8000000000000000 to minutes)
-    if int(timestamp_str) == NEVER_TIMESTAMP:
-        return 0
-    else:
-        return abs(int(timestamp_str)) / (1e7 * 60)
-
-
-def timestamp_to_days(timestamp_str):
-    """Converts a timestamp in -100 nanosecond units to days"""
-    return timestamp_to_mins(timestamp_str) / (60 * 24)
-
-
 class cmd_domain_passwordsettings_show(Command):
     """Display current password settings for the domain."""
 
diff --git a/python/samba/netcmd/drs.py b/python/samba/netcmd/drs.py
index 023b09d0506..5b439f8e6e1 100644
--- a/python/samba/netcmd/drs.py
+++ b/python/samba/netcmd/drs.py
@@ -33,6 +33,7 @@ from samba.netcmd import (
     Option,
     SuperCommand,
 )
+from samba.netcmd.common import attr_default
 from samba.samdb import SamDB
 from samba import drs_utils, nttime2string, dsdb
 from samba.dcerpc import drsuapi, misc
@@ -75,13 +76,6 @@ def drs_errmsg(werr):
     return "failed, result %u (%s)" % (ecode, estring)
 
 
-def attr_default(msg, attrname, default):
-    '''get an attribute from a ldap msg with a default'''
-    if attrname in msg:
-        return msg[attrname][0]
-    return default
-
-
 def drs_parse_ntds_dn(ntds_dn):
     '''parse a NTDS DN returning a site and server'''
     a = ntds_dn.split(',')
diff --git a/python/samba/netcmd/gpo.py b/python/samba/netcmd/gpo.py
index bbaa0c17881..ca479207d6e 100644
--- a/python/samba/netcmd/gpo.py
+++ b/python/samba/netcmd/gpo.py
@@ -63,13 +63,7 @@ from samba.gp_parse.gp_inf import GptTmplInfParser
 from samba.gp_parse.gp_aas import GPAasParser
 from samba import param
 from samba.credentials import SMB_SIGNING_REQUIRED
-
-
-def attr_default(msg, attrname, default):
-    '''get an attribute from a ldap msg with a default'''
-    if attrname in msg:
-        return msg[attrname][0]
-    return default
+from samba.netcmd.common import attr_default
 
 
 def gpo_flags_string(value):
diff --git a/python/samba/netcmd/pso.py b/python/samba/netcmd/pso.py
index 200b6ff2a9e..d260e3bd406 100644
--- a/python/samba/netcmd/pso.py
+++ b/python/samba/netcmd/pso.py
@@ -22,30 +22,15 @@ from samba.netcmd import (Command, CommandError, Option, SuperCommand)
 from samba.dcerpc.samr import (DOMAIN_PASSWORD_COMPLEX,
                                DOMAIN_PASSWORD_STORE_CLEARTEXT)
 from samba.auth import system_session
-
-NEVER_TIMESTAMP = int(-0x8000000000000000)
+from samba.netcmd.common import (NEVER_TIMESTAMP,
+                                 timestamp_to_mins,
+                                 timestamp_to_days)
 
 
 def pso_container(samdb):
     return "CN=Password Settings Container,CN=System,%s" % samdb.domain_dn()
 
 
-def timestamp_to_mins(timestamp_str):
-    """Converts a timestamp in -100 nanosecond units to minutes"""
-    # treat a timestamp of 'never' the same as zero (this should work OK for
-    # most settings, and it displays better than trying to convert
-    # -0x8000000000000000 to minutes)
-    if int(timestamp_str) == NEVER_TIMESTAMP:
-        return 0
-    else:
-        return abs(int(timestamp_str)) / (1e7 * 60)
-
-
-def timestamp_to_days(timestamp_str):
-    """Converts a timestamp in -100 nanosecond units to days"""
-    return timestamp_to_mins(timestamp_str) / (60 * 24)
-
-
 def mins_to_timestamp(mins):
     """Converts a value in minutes to -100 nanosecond units"""
     timestamp = -int((1e7) * 60 * mins)
diff --git a/python/samba/provision/__init__.py b/python/samba/provision/__init__.py
index 0706f39c581..136267e7aad 100644
--- a/python/samba/provision/__init__.py
+++ b/python/samba/provision/__init__.py
@@ -499,21 +499,6 @@ class ProvisionResult(object):
             self.backend_result.report_logger(logger)
 
 
-def check_install(lp, session_info, credentials):
-    """Check whether the current install seems ok.
-
-    :param lp: Loadparm context
-    :param session_info: Session information
-    :param credentials: Credentials
-    """
-    if lp.get("realm") == "":
-        raise Exception("Realm empty")
-    samdb = Ldb(lp.samdb_url(), session_info=session_info,
-                credentials=credentials, lp=lp)
-    if len(samdb.search("(cn=Administrator)")) != 1:
-        raise ProvisioningError("No administrator account found")
-
-
 def findnss(nssfn, names):
     """Find a user or group from a list of possibilities.
 
diff --git a/selftest/subunithelper.py b/selftest/subunithelper.py
index 26158cad339..4fbb5442839 100644
--- a/selftest/subunithelper.py
+++ b/selftest/subunithelper.py
@@ -45,10 +45,7 @@ def parse_results(msg_ops, statistics, fh):
     exitcode = 0
     open_tests = {}
 
-    while fh:
-        l = fh.readline()
-        if l == "":
-            break
+    for l in fh:
         parts = l.split(None, 1)
         if not len(parts) == 2 or not l.startswith(parts[0]):
             msg_ops.output_msg(l)
@@ -80,10 +77,7 @@ def parse_results(msg_ops, statistics, fh):
                 reason = ""
                 # reason may be specified in next lines
                 terminated = False
-                while fh:
-                    l = fh.readline()
-                    if l == "":
-                        break
+                for l in fh:
                     msg_ops.control_msg(l)
                     if l == "]\n":
                         terminated = True
@@ -250,8 +244,7 @@ def read_test_regexes(*names):
             files.append(name)
 
     for filename in files:
-        f = open(filename, 'r')
-        try:
+        with open(filename, 'r') as f:
             for l in f:
                 l = l.strip()
                 if l == "" or l[0] == "#":
@@ -261,8 +254,7 @@ def read_test_regexes(*names):
                     ret[regex.strip()] = reason.strip()
                 else:
                     ret[l] = None
-        finally:
-            f.close()
+
     return ret
 
 


-- 
Samba Shared Repository


From dmulder at samba.org  Wed Dec  9 18:43:02 2020
From: dmulder at samba.org (David Mulder)
Date: Wed, 09 Dec 2020 18:43:02 +0000
Subject: [SCM] Samba Shared Repository - branch master updated
Message-ID: <E1kn4QY-000pGA-36@hrx0.samba.org>

The branch, master has been updated
       via  4fa938e7e5f WHATSNEW: samba-tool gpo manage command
       via  ef5ea147ddc samba-tool: Add a gpo command for setting smb.conf Group Policy
       via  2705d39bff3 samba-tool: Test gpo smb.conf set command
       via  fff3e0eb6af samba-tool: Add a gpo command for listing smb.conf Group Policies
       via  f74dea08be4 samba-tool: Test gpo smb.conf list command
       via  111f07fd58b samba-tool: Add a gpo command for listing Security Group Policies
       via  aba8ece11d2 samba-tool: Test gpo Security list
       via  eea46a38ebe samba-tool: Add a gpo command for setting Security Group Policy
       via  5b49e0ac71c samba-tool: Test gpo Security set command
       via  f509550f872 samba-tool: Add a gpo command for removing Sudoers Group Policy
       via  f67a3644f41 samba-tool: Test gpo Sudoers remove command
       via  5f9d2456fba samba-tool: Add a gpo command for adding Sudoers Group Policy
       via  b0ccebd3ee6 samba-tool: Test gpo Sudoers add command
       via  b402c7642c5 samba-tool: Add a gpo command for listing Sudoers Group Policies
       via  6f1374844c3 samba-tool: Test gpo Sudoers list command
      from  cc9ff79d86c dbcheck: err_normalise-mismatch_replace: no msg if no error

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 4fa938e7e5f56b23eb4b3bfa560f50fabdcba8e4
Author: David Mulder <dmulder at suse.com>
Date:   Fri Dec 4 08:53:54 2020 -0700

    WHATSNEW: samba-tool gpo manage command
    
    Signed-off-by: David Mulder <dmulder at suse.com>
    Reviewed-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
    
    Autobuild-User(master): David Mulder <dmulder at samba.org>
    Autobuild-Date(master): Wed Dec  9 18:42:29 UTC 2020 on sn-devel-184

commit ef5ea147ddcc81830eec3405c648f2124c9d27cf
Author: David Mulder <dmulder at suse.com>
Date:   Fri Nov 13 08:39:26 2020 -0700

    samba-tool: Add a gpo command for setting smb.conf Group Policy
    
    Signed-off-by: David Mulder <dmulder at suse.com>
    Reviewed-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>

commit 2705d39bff3ddb74c78659866079195b921af5ed
Author: David Mulder <dmulder at suse.com>
Date:   Fri Nov 13 07:28:00 2020 -0700

    samba-tool: Test gpo smb.conf set command
    
    Signed-off-by: David Mulder <dmulder at suse.com>
    Reviewed-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>

commit fff3e0eb6afe4ef2d6b74bf80413c74b176bc441
Author: David Mulder <dmulder at suse.com>
Date:   Thu Nov 12 11:19:37 2020 -0700

    samba-tool: Add a gpo command for listing smb.conf Group Policies
    
    Signed-off-by: David Mulder <dmulder at suse.com>
    Reviewed-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>

commit f74dea08be48dcb194570d9ff0ef2a30c2cf878e
Author: David Mulder <dmulder at suse.com>
Date:   Thu Nov 12 11:13:50 2020 -0700

    samba-tool: Test gpo smb.conf list command
    
    Signed-off-by: David Mulder <dmulder at suse.com>
    Reviewed-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>

commit 111f07fd58b7a7f798cc10e40a44e7fcdd8e207f
Author: David Mulder <dmulder at suse.com>
Date:   Fri Nov 6 10:44:28 2020 -0700

    samba-tool: Add a gpo command for listing Security Group Policies
    
    Signed-off-by: David Mulder <dmulder at suse.com>
    Reviewed-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>

commit aba8ece11d21aafbb3b42a3c24b18c5f9c5559f7
Author: David Mulder <dmulder at suse.com>
Date:   Mon Nov 9 16:28:11 2020 -0700

    samba-tool: Test gpo Security list
    
    Signed-off-by: David Mulder <dmulder at suse.com>
    Reviewed-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>

commit eea46a38ebe3de36063f663068933818cef19ff6
Author: David Mulder <dmulder at suse.com>
Date:   Fri Nov 6 12:19:12 2020 -0700

    samba-tool: Add a gpo command for setting Security Group Policy
    
    Signed-off-by: David Mulder <dmulder at suse.com>
    Reviewed-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>

commit 5b49e0ac71c2e10b73c8c67f0cb9547b70b8d021
Author: David Mulder <dmulder at suse.com>
Date:   Tue Nov 10 08:05:37 2020 -0700

    samba-tool: Test gpo Security set command
    
    Signed-off-by: David Mulder <dmulder at suse.com>
    Reviewed-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>

commit f509550f872424a67d4fbc9473c8959e53dffb70
Author: David Mulder <dmulder at suse.com>
Date:   Fri Nov 6 09:54:59 2020 -0700

    samba-tool: Add a gpo command for removing Sudoers Group Policy
    
    Signed-off-by: David Mulder <dmulder at suse.com>
    Reviewed-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>

commit f67a3644f413dd4c902af6970cd18cf17f469cd2
Author: David Mulder <dmulder at suse.com>
Date:   Mon Nov 9 16:08:59 2020 -0700

    samba-tool: Test gpo Sudoers remove command
    
    Signed-off-by: David Mulder <dmulder at suse.com>
    Reviewed-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>

commit 5f9d2456fbaeeb5674edb228a3022ee749376715
Author: David Mulder <dmulder at suse.com>
Date:   Fri Nov 6 09:30:35 2020 -0700

    samba-tool: Add a gpo command for adding Sudoers Group Policy
    
    Signed-off-by: David Mulder <dmulder at suse.com>
    Reviewed-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>

commit b0ccebd3ee65b8a9e4d09e1ef9121fc8c6a336b4
Author: David Mulder <dmulder at suse.com>
Date:   Mon Nov 9 15:48:28 2020 -0700

    samba-tool: Test gpo Sudoers add command
    
    Signed-off-by: David Mulder <dmulder at suse.com>
    Reviewed-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>

commit b402c7642c5569bd0d8a6a9df4859f8bd89784b7
Author: David Mulder <dmulder at suse.com>
Date:   Fri Nov 6 09:29:57 2020 -0700

    samba-tool: Add a gpo command for listing Sudoers Group Policies
    
    Signed-off-by: David Mulder <dmulder at suse.com>
    Reviewed-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>

commit 6f1374844c3bced28ac59633d12f2125a74376db
Author: David Mulder <dmulder at suse.com>
Date:   Mon Nov 9 08:34:28 2020 -0700

    samba-tool: Test gpo Sudoers list command
    
    Signed-off-by: David Mulder <dmulder at suse.com>
    Reviewed-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>

-----------------------------------------------------------------------

Summary of changes:
 WHATSNEW.txt                         |   4 +-
 python/samba/netcmd/gpo.py           | 586 ++++++++++++++++++++++++++++++++++-
 python/samba/tests/samba_tool/gpo.py | 232 ++++++++++++++
 3 files changed, 820 insertions(+), 2 deletions(-)


Changeset truncated at 500 lines:

diff --git a/WHATSNEW.txt b/WHATSNEW.txt
index 9cfd2840b17..d53a7da1e8b 100644
--- a/WHATSNEW.txt
+++ b/WHATSNEW.txt
@@ -69,7 +69,9 @@ Administration of Samba policy requires that a Samba ADMX template be uploaded
 to the SYSVOL share. The samba-tool command `samba-tool gpo admxload` is
 provided as a convenient method for adding this policy. Once uploaded, policies
 can be modified in the Group Policy Management Editor under Computer
-Configuration/Policies/Administrative Templates.
+Configuration/Policies/Administrative Templates. Alternatively, Samba policy
+may be managed using the `samba-tool gpo manage` command. This tool does not
+require the admx templates to be installed.
 
 CTDB CHANGES
 ============
diff --git a/python/samba/netcmd/gpo.py b/python/samba/netcmd/gpo.py
index ca479207d6e..8be7368282f 100644
--- a/python/samba/netcmd/gpo.py
+++ b/python/samba/netcmd/gpo.py
@@ -37,7 +37,8 @@ from samba.netcmd import (
 from samba.samdb import SamDB
 from samba import dsdb
 from samba.dcerpc import security
-from samba.ndr import ndr_unpack
+from samba.ndr import ndr_unpack, ndr_pack
+from samba.dcerpc import preg
 import samba.security
 import samba.auth
 from samba.auth import AUTH_SESSION_INFO_DEFAULT_GROUPS, AUTH_SESSION_INFO_AUTHENTICATED, AUTH_SESSION_INFO_SIMPLE_PRIVILEGES
@@ -64,6 +65,9 @@ from samba.gp_parse.gp_aas import GPAasParser
 from samba import param
 from samba.credentials import SMB_SIGNING_REQUIRED
 from samba.netcmd.common import attr_default
+from samba.common import get_bytes, get_string
+from configparser import ConfigParser
+from io import StringIO
 
 
 def gpo_flags_string(value):
@@ -1664,6 +1668,585 @@ class cmd_admxload(Command):
                             raise CommandError("The authenticated user does "
                                                "not have sufficient privileges")
 
+class cmd_add_sudoers(Command):
+    """Adds a Samba Sudoers Group Policy to the sysvol
+
+This command adds a sudo rule to the sysvol for applying to winbind clients.
+
+Example:
+samba-tool gpo manage sudoers add {31B2F340-016D-11D2-945F-00C04FB984F9} 'fakeu ALL=(ALL) NOPASSWD: ALL'
+    """
+
+    synopsis = "%prog <gpo> <entry> [options]"
+
+    takes_optiongroups = {
+        "sambaopts": options.SambaOptions,
+        "versionopts": options.VersionOptions,
+        "credopts": options.CredentialsOptions,
+    }
+
+    takes_options = [
+        Option("-H", "--URL", help="LDB URL for database or target server", type=str,
+                metavar="URL", dest="H"),
+    ]
+
+    takes_args = ["gpo", "entry"]
+
+    def run(self, gpo, entry, H=None, sambaopts=None, credopts=None, versionopts=None):
+        self.lp = sambaopts.get_loadparm()
+        self.creds = credopts.get_credentials(self.lp, fallback_machine=True)
+
+        # We need to know writable DC to setup SMB connection
+        if H and H.startswith('ldap://'):
+            dc_hostname = H[7:]
+            self.url = H
+        else:
+            dc_hostname = netcmd_finddc(self.lp, self.creds)
+            self.url = dc_url(self.lp, self.creds, dc=dc_hostname)
+
+        # SMB connect to DC
+        conn = smb_connection(dc_hostname,
+                              'sysvol',
+                              lp=self.lp,
+                              creds=self.creds)
+
+        realm = self.lp.get('realm')
+        pol_dir = '\\'.join([realm.lower(), 'Policies', gpo, 'MACHINE'])
+        pol_file = '\\'.join([pol_dir, 'Registry.pol'])
+        try:
+            pol_data = ndr_unpack(preg.file, conn.loadfile(pol_file))
+        except NTSTATUSError as e:
+            # STATUS_OBJECT_NAME_INVALID, STATUS_OBJECT_NAME_NOT_FOUND
+            if e.args[0] in [0xC0000033, 0xC0000034]:
+                pol_data = preg.file() # The file doesn't exist
+            elif e.args[0] == 0xC0000022: # STATUS_ACCESS_DENIED
+                raise CommandError("The authenticated user does "
+                                   "not have sufficient privileges")
+            else:
+                raise
+
+        e = preg.entry()
+        e.keyname = b'Software\\Policies\\Samba\\Unix Settings\\Sudo Rights'
+        e.valuename = b'Software\\Policies\\Samba\\Unix Settings'
+        e.type = 1
+        e.data = get_bytes(entry)
+        entries = list(pol_data.entries)
+        entries.append(e)
+        pol_data.entries = entries
+        pol_data.num_entries = len(entries)
+
+        try:
+            create_directory_hier(conn, pol_dir)
+            conn.savefile(pol_file, ndr_pack(pol_data))
+        except NTSTATUSError as e:
+            if e.args[0] == 0xC0000022: # STATUS_ACCESS_DENIED
+                raise CommandError("The authenticated user does "
+                                   "not have sufficient privileges")
+            raise
+
+class cmd_list_sudoers(Command):
+    """List Samba Sudoers Group Policy from the sysvol
+
+This command lists sudo rules from the sysvol that will be applied to winbind clients.
+
+Example:
+samba-tool gpo manage sudoers list {31B2F340-016D-11D2-945F-00C04FB984F9}
+    """
+
+    synopsis = "%prog <gpo> [options]"
+
+    takes_optiongroups = {
+        "sambaopts": options.SambaOptions,
+        "versionopts": options.VersionOptions,
+        "credopts": options.CredentialsOptions,
+    }
+
+    takes_options = [
+        Option("-H", "--URL", help="LDB URL for database or target server", type=str,
+                metavar="URL", dest="H"),
+    ]
+
+    takes_args = ["gpo"]
+
+    def run(self, gpo, H=None, sambaopts=None, credopts=None, versionopts=None):
+        self.lp = sambaopts.get_loadparm()
+        self.creds = credopts.get_credentials(self.lp, fallback_machine=True)
+
+        # We need to know writable DC to setup SMB connection
+        if H and H.startswith('ldap://'):
+            dc_hostname = H[7:]
+            self.url = H
+        else:
+            dc_hostname = netcmd_finddc(self.lp, self.creds)
+            self.url = dc_url(self.lp, self.creds, dc=dc_hostname)
+
+        # SMB connect to DC
+        conn = smb_connection(dc_hostname,
+                              'sysvol',
+                              lp=self.lp,
+                              creds=self.creds)
+
+        realm = self.lp.get('realm')
+        pol_file = '\\'.join([realm.lower(), 'Policies', gpo,
+                                'MACHINE\\Registry.pol'])
+        try:
+            pol_data = ndr_unpack(preg.file, conn.loadfile(pol_file))
+        except NTSTATUSError as e:
+            if e.args[0] == 0xC0000033: # STATUS_OBJECT_NAME_INVALID
+                return # The file doesn't exist, so there is nothing to list
+            if e.args[0] == 0xC0000022: # STATUS_ACCESS_DENIED
+                raise CommandError("The authenticated user does "
+                                   "not have sufficient privileges")
+            raise
+
+        keyname = b'Software\\Policies\\Samba\\Unix Settings\\Sudo Rights'
+        for entry in pol_data.entries:
+            if get_bytes(entry.keyname) == keyname:
+                self.outf.write('%s\n' % entry.data)
+
+class cmd_remove_sudoers(Command):
+    """Removes a Samba Sudoers Group Policy from the sysvol
+
+This command removes a sudo rule from the sysvol from applying to winbind clients.
+
+Example:
+samba-tool gpo manage sudoers remove {31B2F340-016D-11D2-945F-00C04FB984F9} 'fakeu ALL=(ALL) NOPASSWD: ALL'
+    """
+
+    synopsis = "%prog <gpo> <entry> [options]"
+
+    takes_optiongroups = {
+        "sambaopts": options.SambaOptions,
+        "versionopts": options.VersionOptions,
+        "credopts": options.CredentialsOptions,
+    }
+
+    takes_options = [
+        Option("-H", "--URL", help="LDB URL for database or target server", type=str,
+                metavar="URL", dest="H"),
+    ]
+
+    takes_args = ["gpo", "entry"]
+
+    def run(self, gpo, entry, H=None, sambaopts=None, credopts=None, versionopts=None):
+        self.lp = sambaopts.get_loadparm()
+        self.creds = credopts.get_credentials(self.lp, fallback_machine=True)
+
+        # We need to know writable DC to setup SMB connection
+        if H and H.startswith('ldap://'):
+            dc_hostname = H[7:]
+            self.url = H
+        else:
+            dc_hostname = netcmd_finddc(self.lp, self.creds)
+            self.url = dc_url(self.lp, self.creds, dc=dc_hostname)
+
+        # SMB connect to DC
+        conn = smb_connection(dc_hostname,
+                              'sysvol',
+                              lp=self.lp,
+                              creds=self.creds)
+
+        realm = self.lp.get('realm')
+        pol_file = '\\'.join([realm.lower(), 'Policies', gpo,
+                                'MACHINE\\Registry.pol'])
+        try:
+            pol_data = ndr_unpack(preg.file, conn.loadfile(pol_file))
+        except NTSTATUSError as e:
+            if e.args[0] == 0xC0000033: # STATUS_OBJECT_NAME_INVALID
+                raise CommandError("The specified entry does not exist")
+            elif e.args[0] == 0xC0000022: # STATUS_ACCESS_DENIED
+                raise CommandError("The authenticated user does "
+                                   "not have sufficient privileges")
+            raise
+
+        if entry not in [e.data for e in pol_data.entries]:
+            raise CommandError("Cannot remove '%s' because it does not exist" %
+                                entry)
+
+        entries = [e for e in pol_data.entries if e.data != entry]
+        pol_data.num_entries = len(entries)
+        pol_data.entries = entries
+
+        try:
+            conn.savefile(pol_file, ndr_pack(pol_data))
+        except NTSTATUSError as e:
+            if e.args[0] == 0xC0000022: # STATUS_ACCESS_DENIED
+                raise CommandError("The authenticated user does "
+                                   "not have sufficient privileges")
+            raise
+
+class cmd_sudoers(SuperCommand):
+    """Manage Sudoers Group Policy Objects"""
+    subcommands = {}
+    subcommands["add"] = cmd_add_sudoers()
+    subcommands["list"] = cmd_list_sudoers()
+    subcommands["remove"] = cmd_remove_sudoers()
+
+class cmd_set_security(Command):
+    """Set Samba Security Group Policy to the sysvol
+
+This command sets a security setting to the sysvol for applying to winbind
+clients. Not providing a value will unset the policy.
+These settings only apply to the ADDC.
+
+Example:
+samba-tool gpo manage security set {31B2F340-016D-11D2-945F-00C04FB984F9} MaxTicketAge 10
+
+Possible policies:
+MaxTicketAge            Maximum lifetime for user ticket
+                        Defined in hours
+
+MaxServiceAge           Maximum lifetime for service ticket
+                        Defined in minutes
+
+MaxRenewAge             Maximum lifetime for user ticket renewal
+                        Defined in minutes
+
+MinimumPasswordAge      Minimum password age
+                        Defined in days
+
+MaximumPasswordAge      Maximum password age
+                        Defined in days
+
+MinimumPasswordLength   Minimum password length
+                        Defined in characters
+
+PasswordComplexity      Password must meet complexity requirements
+                        1 is Enabled, 0 is Disabled
+    """
+
+    synopsis = "%prog <gpo> [options]"
+
+    takes_optiongroups = {
+        "sambaopts": options.SambaOptions,
+        "versionopts": options.VersionOptions,
+        "credopts": options.CredentialsOptions,
+    }
+
+    takes_options = [
+        Option("-H", "--URL", help="LDB URL for database or target server", type=str,
+                metavar="URL", dest="H"),
+    ]
+
+    takes_args = ["gpo", "policy", "value?"]
+
+    def run(self, gpo, policy, value=None, H=None, sambaopts=None,
+            credopts=None, versionopts=None):
+        self.lp = sambaopts.get_loadparm()
+        self.creds = credopts.get_credentials(self.lp, fallback_machine=True)
+
+        # We need to know writable DC to setup SMB connection
+        if H and H.startswith('ldap://'):
+            dc_hostname = H[7:]
+            self.url = H
+        else:
+            dc_hostname = netcmd_finddc(self.lp, self.creds)
+            self.url = dc_url(self.lp, self.creds, dc=dc_hostname)
+
+        # SMB connect to DC
+        conn = smb_connection(dc_hostname,
+                              'sysvol',
+                              lp=self.lp,
+                              creds=self.creds)
+
+        realm = self.lp.get('realm')
+        inf_dir = '\\'.join([realm.lower(), 'Policies', gpo,
+            'MACHINE\\Microsoft\\Windows NT\\SecEdit'])
+        inf_file = '\\'.join([inf_dir, 'GptTmpl.inf'])
+        try:
+            inf_data = ConfigParser(interpolation=None)
+            inf_data.optionxform=str
+            raw = conn.loadfile(inf_file)
+            try:
+                inf_data.readfp(StringIO(raw.decode()))
+            except UnicodeDecodeError:
+                inf_data.readfp(StringIO(raw.decode('utf-16')))
+        except NTSTATUSError as e:
+            if e.args[0] == 0xC0000022: # STATUS_ACCESS_DENIED
+                raise CommandError("The authenticated user does "
+                                   "not have sufficient privileges")
+            # STATUS_OBJECT_NAME_INVALID, STATUS_OBJECT_PATH_NOT_FOUND
+            if e.args[0] not in [0xC0000033, 0xC000003A]:
+                raise
+
+        section_map = { 'MaxTicketAge' : 'Kerberos Policy',
+                        'MaxServiceAge' : 'Kerberos Policy',
+                        'MaxRenewAge' : 'Kerberos Policy',
+                        'MinimumPasswordAge' : 'System Access',
+                        'MaximumPasswordAge' : 'System Access',
+                        'MinimumPasswordLength' : 'System Access',
+                        'PasswordComplexity' : 'System Access'
+                    }
+
+        section = section_map[policy]
+        if not inf_data.has_section(section):
+            inf_data.add_section(section)
+        if value is not None:
+            inf_data.set(section, policy, value)
+        else:
+            inf_data.remove_option(section, policy)
+
+        out = StringIO()
+        inf_data.write(out)
+        try:
+            create_directory_hier(conn, inf_dir)
+            conn.savefile(inf_file, get_bytes(out.getvalue()))
+        except NTSTATUSError as e:
+            if e.args[0] == 0xC0000022: # STATUS_ACCESS_DENIED
+                raise CommandError("The authenticated user does "
+                                   "not have sufficient privileges")
+            else:
+                raise
+
+class cmd_list_security(Command):
+    """List Samba Security Group Policy from the sysvol
+
+This command lists security settings from the sysvol that will be applied to winbind clients.
+These settings only apply to the ADDC.
+
+Example:
+samba-tool gpo manage security list {31B2F340-016D-11D2-945F-00C04FB984F9}
+    """
+
+    synopsis = "%prog <gpo> [options]"
+
+    takes_optiongroups = {
+        "sambaopts": options.SambaOptions,
+        "versionopts": options.VersionOptions,
+        "credopts": options.CredentialsOptions,
+    }
+
+    takes_options = [
+        Option("-H", "--URL", help="LDB URL for database or target server", type=str,
+                metavar="URL", dest="H"),
+    ]
+
+    takes_args = ["gpo"]
+
+    def run(self, gpo, H=None, sambaopts=None, credopts=None, versionopts=None):
+        self.lp = sambaopts.get_loadparm()
+        self.creds = credopts.get_credentials(self.lp, fallback_machine=True)
+
+        # We need to know writable DC to setup SMB connection
+        if H and H.startswith('ldap://'):
+            dc_hostname = H[7:]
+            self.url = H
+        else:
+            dc_hostname = netcmd_finddc(self.lp, self.creds)
+            self.url = dc_url(self.lp, self.creds, dc=dc_hostname)
+
+        # SMB connect to DC
+        conn = smb_connection(dc_hostname,
+                              'sysvol',
+                              lp=self.lp,
+                              creds=self.creds)
+
+        realm = self.lp.get('realm')
+        inf_file = '\\'.join([realm.lower(), 'Policies', gpo,
+            'MACHINE\\Microsoft\\Windows NT\\SecEdit\\GptTmpl.inf'])
+        try:
+            inf_data = ConfigParser(interpolation=None)
+            inf_data.optionxform=str
+            raw = conn.loadfile(inf_file)
+            try:
+                inf_data.readfp(StringIO(raw.decode()))
+            except UnicodeDecodeError:
+                inf_data.readfp(StringIO(raw.decode('utf-16')))
+        except NTSTATUSError as e:
+            if e.args[0] == 0xC0000033: # STATUS_OBJECT_NAME_INVALID
+                return # The file doesn't exist, so there is nothing to list
+            if e.args[0] == 0xC0000022: # STATUS_ACCESS_DENIED
+                raise CommandError("The authenticated user does "
+                                   "not have sufficient privileges")
+            raise
+
+        for section in inf_data.sections():
+            if section not in ['Kerberos Policy', 'System Access']:
+                continue
+            for key, value in inf_data.items(section):
+                self.outf.write('%s = %s\n' % (key, value))
+
+class cmd_security(SuperCommand):
+    """Manage Security Group Policy Objects"""
+    subcommands = {}
+    subcommands["set"] = cmd_set_security()
+    subcommands["list"] = cmd_list_security()
+
+class cmd_list_smb_conf(Command):
+    """List Samba smb.conf Group Policy from the sysvol
+
+This command lists smb.conf settings from the sysvol that will be applied to winbind clients.
+
+Example:
+samba-tool gpo manage smb_conf list {31B2F340-016D-11D2-945F-00C04FB984F9}
+    """
+
+    synopsis = "%prog <gpo> [options]"
+
+    takes_optiongroups = {
+        "sambaopts": options.SambaOptions,
+        "versionopts": options.VersionOptions,
+        "credopts": options.CredentialsOptions,
+    }
+
+    takes_options = [
+        Option("-H", "--URL", help="LDB URL for database or target server", type=str,
+                metavar="URL", dest="H"),
+    ]
+
+    takes_args = ["gpo"]
+
+    def run(self, gpo, H=None, sambaopts=None, credopts=None, versionopts=None):
+        self.lp = sambaopts.get_loadparm()
+        self.creds = credopts.get_credentials(self.lp, fallback_machine=True)
+
+        # We need to know writable DC to setup SMB connection
+        if H and H.startswith('ldap://'):
+            dc_hostname = H[7:]
+            self.url = H
+        else:
+            dc_hostname = netcmd_finddc(self.lp, self.creds)
+            self.url = dc_url(self.lp, self.creds, dc=dc_hostname)
+
+        # SMB connect to DC
+        conn = smb_connection(dc_hostname,
+                              'sysvol',
+                              lp=self.lp,
+                              creds=self.creds)
+
+        realm = self.lp.get('realm')
+        pol_file = '\\'.join([realm.lower(), 'Policies', gpo,
+                                'MACHINE\\Registry.pol'])
+        try:
+            pol_data = ndr_unpack(preg.file, conn.loadfile(pol_file))
+        except NTSTATUSError as e:
+            if e.args[0] == 0xC0000033: # STATUS_OBJECT_NAME_INVALID
+                return # The file doesn't exist, so there is nothing to list
+            if e.args[0] == 0xC0000022: # STATUS_ACCESS_DENIED
+                raise CommandError("The authenticated user does "
+                                   "not have sufficient privileges")


-- 
Samba Shared Repository


From kseeger at samba.org  Wed Dec  9 11:46:02 2020
From: kseeger at samba.org (Karolin Seeger)
Date: Wed, 09 Dec 2020 11:46:02 +0000
Subject: [SCM] Samba Shared Repository - branch v4-12-test updated
Message-ID: <E1kmxv0-0054fA-4p@hrx0.samba.org>

The branch, v4-12-test has been updated
       via  86d4448396b vfs_zfsacl: add missing inherited flag on hidden "magic" everyone@ ACE
       via  eaa736faf67 vfs_zfsacl: reformatting
       via  20480f70ce0 s4/samba: call force_check_log_size() in standard_new_task()
       via  91f2f2dedb7 s4/samba: call force_check_log_size() in standard_accept_connection()
       via  4e6fdf5d8d9 s4/samba: call force_check_log_size() in prefork_reload_after_fork()
       via  b50ef6fa897 s4: call reopen_logs_internal() in the SIGHUP handler of the prefork process model
       via  1a6f2871036 s4: replace low-level SIGUP handler with a tevent handler
       via  7299ebb1215 s4: install tevent tracing hooks to trigger logfile rotation
       via  5b838f5075c s4: add samba server tevent trace helper stuff
       via  6c881025bfa debug: detect logrotation by checking inode number
       via  5cd1e3c5a4a debug: pass struct debug_class *config to do_one_check_log_size()
       via  f6bd782cb3b debug: pass struct debug_class *config to reopen_one_log()
       via  ccf971eef5c loadparm: setup debug subsystem setting max_log_size from config
       via  a30aaa499db s3: smbd: Quiet log messages from usershares for an unknown share.
      from  ecdddde3c53 vfs_glusterfs: print exact cmdline for disabling write-behind translator

https://git.samba.org/?p=samba.git;a=shortlog;h=v4-12-test


- Log -----------------------------------------------------------------
commit 86d4448396b9cb715e5dd9cb3d34eb0e5f0d5a76
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Nov 30 12:28:58 2020 +0100

    vfs_zfsacl: add missing inherited flag on hidden "magic" everyone@ ACE
    
    This was an omission in the fixes for bug 14470.
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14587
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>
    
    Autobuild-User(master): Jeremy Allison <jra at samba.org>
    Autobuild-Date(master): Tue Dec  1 20:29:34 UTC 2020 on sn-devel-184
    
    (cherry picked from commit 936f74daed0d6221312f651f35c4ed357bbf1414)
    
    Autobuild-User(v4-12-test): Karolin Seeger <kseeger at samba.org>
    Autobuild-Date(v4-12-test): Wed Dec  9 11:45:09 UTC 2020 on sn-devel-184

commit eaa736faf676fac706d841d41be4b5c9c0732a31
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Nov 30 12:28:00 2020 +0100

    vfs_zfsacl: reformatting
    
    No change in behaviour.
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14587
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>
    (cherry picked from commit a8457ac3c80e22588e33a343c2306b702734ca88)

commit 20480f70ce0608a1bf296eda8f9dbff8cf746078
Author: Ralph Boehme <slow at samba.org>
Date:   Thu Nov 26 15:24:44 2020 +0100

    s4/samba: call force_check_log_size() in standard_new_task()
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14248
    RN: samba process does not honor max log size
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>
    
    Autobuild-User(master): Jeremy Allison <jra at samba.org>
    Autobuild-Date(master): Mon Dec  7 18:54:29 UTC 2020 on sn-devel-184
    
    (cherry picked from commit 058f96f4c4eda42b404f0067521d3eafb495fe7d)

commit 91f2f2dedb7e9fcac1ebc4849b5e64056905849a
Author: Ralph Boehme <slow at samba.org>
Date:   Thu Nov 26 15:24:26 2020 +0100

    s4/samba: call force_check_log_size() in standard_accept_connection()
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14248
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>
    (cherry picked from commit 6fa5fb8ef26dab862df5c46bb5e74f19839c30e2)

commit 4e6fdf5d8d932af52f029f84da774ae920e3a80f
Author: Ralph Boehme <slow at samba.org>
Date:   Thu Nov 26 15:23:58 2020 +0100

    s4/samba: call force_check_log_size() in prefork_reload_after_fork()
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14248
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    (cherry picked from commit 82b64e930b0e2d3b2e5186017d9f8e420994136c)

commit b50ef6fa897b2c007e17a0ccb38e04bdeb7cec00
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Nov 23 16:44:04 2020 +0100

    s4: call reopen_logs_internal() in the SIGHUP handler of the prefork process model
    
    With debug_schedule_reopen_logs() the actual reopen only takes place at some
    point in the future when a DEBUG message is processed.
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14248
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>
    (cherry picked from commit 19413e76a46f07fdd46fde5e60707bb6845a782d)

commit 1a6f2871036f5271aefa63f745e691a38684b40e
Author: Ralph Boehme <slow at samba.org>
Date:   Fri Nov 20 15:21:03 2020 +0100

    s4: replace low-level SIGUP handler with a tevent handler
    
    Replace the low-level signal handler for SIGHUP with a nice tevent signal
    handler. The low-level handler sig_hup() installed by setup_signals() remains
    being used during early startup before a tevent context is available.
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14248
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>
    (cherry picked from commit 9f71e6173ab43a04804ba8061cb0e8ae6c0165bf)

commit 7299ebb1215776b19f5094e861a21c7df06220f2
Author: Ralph Boehme <slow at samba.org>
Date:   Thu Nov 26 14:21:58 2020 +0100

    s4: install tevent tracing hooks to trigger logfile rotation
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14248
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>
    (backported from commit 516c2a04a242a539f9fbddb2822295fee233644c)
    [slow at samba.org: process_prefork.c has additional include in master]

commit 5b838f5075c856779a38d9a2a023bf1b33cb1afd
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Nov 23 17:53:57 2020 +0100

    s4: add samba server tevent trace helper stuff
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14248
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>
    (backported from commit 68f71f227b17774a12c84575c1eecd82279fac95)
    [slow at samba.org: conflict due to rename source4/smbd/ -> source4/samba/ in master]

commit 6c881025bfa45927076e1b995bf948f0434417ae
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Nov 23 16:04:03 2020 +0100

    debug: detect logrotation by checking inode number
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14248
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>
    (cherry picked from commit 3651a51e93b45104323d5db1d5ea704d4f71acf1)

commit 5cd1e3c5a4aade5d589ad7df613766e0cb38f342
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Nov 23 15:51:09 2020 +0100

    debug: pass struct debug_class *config to do_one_check_log_size()
    
    Pass a pointer to the struct instead of all struct members individually. No
    change in behaviour.
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14248
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>
    (cherry picked from commit b7ee36146458bcc2c944f5670b7632df8281ae61)

commit f6bd782cb3b68354c6ebe1bae7fd82f4c5f5fb1f
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Nov 23 15:46:47 2020 +0100

    debug: pass struct debug_class *config to reopen_one_log()
    
    Pass a pointer to the struct instead of all struct members individually. No
    change in behaviour.
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14248
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>
    (cherry picked from commit 29cd139a32d5dbf36bef68eb9c7f1160201e3042)

commit ccf971eef5c780031915fc61bf6bc1ffeb24e73d
Author: Ralph Boehme <slow at samba.org>
Date:   Fri Nov 13 12:34:50 2020 +0100

    loadparm: setup debug subsystem setting max_log_size from config
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14248
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>
    (cherry picked from commit ab2c712c016f4e4dacd5064b9eb8f6417f4b9b60)

commit a30aaa499db06023e11aa35cf66b105d1a5b56e4
Author: Jeremy Allison <jra at samba.org>
Date:   Wed Dec 2 11:47:02 2020 -0800

    s3: smbd: Quiet log messages from usershares for an unknown share.
    
    No need to log missing shares/sharenames at debug level zero.
    
    Keep the debug level zero for all other usershare problems.
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14590
    
    Signed-off-by: Jeremy Allison <jra at samba.org>
    Reviewed-by: Rowland penny <rpenny at samba.org>
    Reviewed-by: Andrew Bartlett <abartlet at samba.org>
    
    Autobuild-User(master): Jeremy Allison <jra at samba.org>
    Autobuild-Date(master): Fri Dec  4 20:54:06 UTC 2020 on sn-devel-184
    
    (cherry picked from commit 8a0a7359faba642baf55a8f98ff78c0d0884d0f0)

-----------------------------------------------------------------------

Summary of changes:
 lib/param/loadparm.c                               |  1 +
 lib/util/debug.c                                   | 63 ++++++++++-----
 source3/modules/vfs_zfsacl.c                       |  6 +-
 source3/param/loadparm.c                           | 10 +++
 source4/smbd/process_prefork.c                     | 16 +++-
 source4/smbd/process_standard.c                    |  4 +
 source4/smbd/server.c                              | 46 +++++++++++
 source4/smbd/server_util.c                         | 94 ++++++++++++++++++++++
 .../winbindd_ads.h => source4/smbd/server_util.h   | 18 ++---
 source4/smbd/wscript_build                         |  9 ++-
 10 files changed, 233 insertions(+), 34 deletions(-)
 create mode 100644 source4/smbd/server_util.c
 copy source3/winbindd/winbindd_ads.h => source4/smbd/server_util.h (67%)


Changeset truncated at 500 lines:

diff --git a/lib/param/loadparm.c b/lib/param/loadparm.c
index 63291283905..8bca0ee632a 100644
--- a/lib/param/loadparm.c
+++ b/lib/param/loadparm.c
@@ -3159,6 +3159,7 @@ static bool lpcfg_update(struct loadparm_context *lp_ctx)
 	settings.debug_pid = lp_ctx->globals->debug_pid;
 	settings.debug_uid = lp_ctx->globals->debug_uid;
 	settings.debug_class = lp_ctx->globals->debug_class;
+	settings.max_log_size = lp_ctx->globals->max_log_size;
 	debug_set_settings(&settings, lp_ctx->globals->logging,
 			   lp_ctx->globals->syslog,
 			   lp_ctx->globals->syslog_only);
diff --git a/lib/util/debug.c b/lib/util/debug.c
index 1650551a766..692e97e3390 100644
--- a/lib/util/debug.c
+++ b/lib/util/debug.c
@@ -113,6 +113,8 @@ struct debug_class {
 	 */
 	char *logfile;
 	int fd;
+	/* inode number of the logfile to detect logfile rotation */
+	ino_t ino;
 };
 
 static const char *default_classname_table[] = {
@@ -1082,14 +1084,17 @@ static void debug_callback_log(const char *msg, int msg_level)
  Fix from dgibson at linuxcare.com.
 **************************************************************************/
 
-static bool reopen_one_log(int *fd, const char *logfile)
+static bool reopen_one_log(struct debug_class *config)
 {
-	int old_fd = *fd;
+	int old_fd = config->fd;
+	const char *logfile = config->logfile;
+	struct stat st;
 	int new_fd;
+	int ret;
 
 	if (logfile == NULL) {
 		debug_close_fd(old_fd);
-		*fd = -1;
+		config->fd = -1;
 		return true;
 	}
 
@@ -1104,8 +1109,18 @@ static bool reopen_one_log(int *fd, const char *logfile)
 
 	debug_close_fd(old_fd);
 	smb_set_close_on_exec(new_fd);
-	*fd = new_fd;
+	config->fd = new_fd;
 
+	ret = fstat(new_fd, &st);
+	if (ret != 0) {
+		log_overflow = true;
+		DBG_ERR("Unable to fstat() new log file '%s': %s\n",
+			logfile, strerror(errno));
+		log_overflow = false;
+		return false;
+	}
+
+	config->ino = st.st_ino;
 	return true;
 }
 
@@ -1164,8 +1179,7 @@ bool reopen_logs_internal(void)
 	state.reopening_logs = true;
 
 	for (i = DBGC_ALL; i < debug_num_classes; i++) {
-		ok = reopen_one_log(&dbgc_config[i].fd,
-				    dbgc_config[i].logfile);
+		ok = reopen_one_log(&dbgc_config[i]);
 		if (!ok) {
 			break;
 		}
@@ -1249,51 +1263,62 @@ bool need_to_check_log_size(void)
  Check to see if the log has grown to be too big.
  **************************************************************************/
 
-static void do_one_check_log_size(off_t maxlog, int *_fd, const char *logfile)
+static void do_one_check_log_size(off_t maxlog, struct debug_class *config)
 {
-	char name[strlen(logfile) + 5];
+	char name[strlen(config->logfile) + 5];
 	struct stat st;
-	int fd = *_fd;
 	int ret;
+	bool reopen = false;
 	bool ok;
 
 	if (maxlog == 0) {
 		return;
 	}
 
-	ret = fstat(fd, &st);
+	ret = stat(config->logfile, &st);
 	if (ret != 0) {
 		return;
 	}
-	if (st.st_size < maxlog ) {
+	if (st.st_size >= maxlog ) {
+		reopen = true;
+	}
+
+	if (st.st_ino != config->ino) {
+		reopen = true;
+	}
+
+	if (!reopen) {
 		return;
 	}
 
 	/* reopen_logs_internal() modifies *_fd */
 	(void)reopen_logs_internal();
-	fd = *_fd;
 
-	if (fd <= 2) {
+	if (config->fd <= 2) {
 		return;
 	}
-	ret = fstat(fd, &st);
+	ret = fstat(config->fd, &st);
 	if (ret != 0) {
+		config->ino = (ino_t)0;
 		return;
 	}
+
+	config->ino = st.st_ino;
+
 	if (st.st_size < maxlog) {
 		return;
 	}
 
-	snprintf(name, sizeof(name), "%s.old", logfile);
+	snprintf(name, sizeof(name), "%s.old", config->logfile);
 
-	(void)rename(logfile, name);
+	(void)rename(config->logfile, name);
 
 	ok = reopen_logs_internal();
 	if (ok) {
 		return;
 	}
 	/* We failed to reopen a log - continue using the old name. */
-	(void)rename(name, logfile);
+	(void)rename(name, config->logfile);
 }
 
 static void do_check_log_size(off_t maxlog)
@@ -1307,9 +1332,7 @@ static void do_check_log_size(off_t maxlog)
 		if (dbgc_config[i].logfile == NULL) {
 			continue;
 		}
-		do_one_check_log_size(maxlog,
-				      &dbgc_config[i].fd,
-				      dbgc_config[i].logfile);
+		do_one_check_log_size(maxlog, &dbgc_config[i]);
 	}
 }
 
diff --git a/source3/modules/vfs_zfsacl.c b/source3/modules/vfs_zfsacl.c
index 9626f21a522..ba8ef9504e2 100644
--- a/source3/modules/vfs_zfsacl.c
+++ b/source3/modules/vfs_zfsacl.c
@@ -219,8 +219,10 @@ static bool zfs_process_smbacl(vfs_handle_struct *handle, files_struct *fsp,
 	}
 	if (must_add_empty_ace) {
 		acebuf[i].a_type = SMB_ACE4_ACCESS_ALLOWED_ACE_TYPE;
-		acebuf[i].a_flags = SMB_ACE4_DIRECTORY_INHERIT_ACE| \
-				    SMB_ACE4_FILE_INHERIT_ACE|ACE_EVERYONE;
+		acebuf[i].a_flags = SMB_ACE4_DIRECTORY_INHERIT_ACE |
+			SMB_ACE4_FILE_INHERIT_ACE |
+			ACE_EVERYONE |
+			ACE_INHERITED_ACE;
 		acebuf[i].a_access_mask = 0;
 		i++;
 	}
diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c
index d3d81f6ece5..64e7afb5d86 100644
--- a/source3/param/loadparm.c
+++ b/source3/param/loadparm.c
@@ -3417,6 +3417,11 @@ static int process_usershare_file(const char *dir_name, const char *file_name, i
 	   open and fstat. Ensure this isn't a symlink link. */
 
 	if (sys_lstat(fname, &lsbuf, false) != 0) {
+		if (errno == ENOENT) {
+			/* Unknown share requested. Just ignore. */
+			goto out;
+		}
+		/* Only log messages for meaningful problems. */
 		DEBUG(0,("process_usershare_file: stat of %s failed. %s\n",
 			fname, strerror(errno) ));
 		goto out;
@@ -3622,6 +3627,11 @@ int load_usershare_service(const char *servicename)
 	int max_user_shares = Globals.usershare_max_shares;
 	int snum_template = -1;
 
+	if (servicename[0] == '\0') {
+		/* Invalid service name. */
+		return -1;
+	}
+
 	if (*usersharepath == 0 ||  max_user_shares == 0) {
 		return -1;
 	}
diff --git a/source4/smbd/process_prefork.c b/source4/smbd/process_prefork.c
index 5667fb5f1ef..ec0ebc24029 100644
--- a/source4/smbd/process_prefork.c
+++ b/source4/smbd/process_prefork.c
@@ -44,6 +44,7 @@
 #include "ldb_wrap.h"
 #include "lib/util/tfork.h"
 #include "lib/messaging/irpc.h"
+#include "server_util.h"
 
 #define min(a, b) (((a) < (b)) ? (a) : (b))
 
@@ -113,7 +114,7 @@ static void sighup_signal_handler(struct tevent_context *ev,
 				int signum, int count, void *siginfo,
 				void *private_data)
 {
-	debug_schedule_reopen_logs();
+	reopen_logs_internal();
 }
 
 static void sigterm_signal_handler(struct tevent_context *ev,
@@ -153,6 +154,7 @@ static void prefork_reload_after_fork(void)
 	if (!NT_STATUS_IS_OK(status)) {
 		smb_panic("Failed to re-initialise imessaging after fork");
 	}
+	force_check_log_size();
 }
 
 /*
@@ -243,6 +245,7 @@ static void prefork_fork_master(
 	struct tevent_context *ev2;
 	struct task_server *task = NULL;
 	struct process_details pd = initial_process_details;
+	struct samba_tevent_trace_state *samba_tevent_trace_state = NULL;
 	int control_pipe[2];
 
 	t = tfork_create();
@@ -321,6 +324,17 @@ static void prefork_fork_master(
 	 */
 	ev2 = s4_event_context_init(NULL);
 
+	samba_tevent_trace_state = create_samba_tevent_trace_state(ev2);
+	if (samba_tevent_trace_state == NULL) {
+		TALLOC_FREE(ev);
+		TALLOC_FREE(ev2);
+		exit(127);
+	}
+
+	tevent_set_trace_callback(ev2,
+				  samba_tevent_trace_callback,
+				  samba_tevent_trace_state);
+
 	/* setup this new connection: process will bind to it's sockets etc
 	 *
 	 * While we can use ev for the child, which has been re-initialised
diff --git a/source4/smbd/process_standard.c b/source4/smbd/process_standard.c
index 139339c92ec..c5f6ec7f402 100644
--- a/source4/smbd/process_standard.c
+++ b/source4/smbd/process_standard.c
@@ -401,6 +401,8 @@ static void standard_accept_connection(
 	talloc_free(c);
 	talloc_free(s);
 
+	force_check_log_size();
+
 	/* setup this new connection.  Cluster ID is PID based for this process model */
 	new_conn(ev, lp_ctx, sock2, cluster_id(pid, 0), private_data,
 		 process_context);
@@ -502,6 +504,8 @@ static void standard_new_task(struct tevent_context *ev,
 
 	setproctitle("task[%s]", service_name);
 
+	force_check_log_size();
+
 	/*
 	 * Set up the process context to be passed through to the terminate
 	 * and accept_connection functions
diff --git a/source4/smbd/server.c b/source4/smbd/server.c
index 95acb99b86c..9068bfcaeb8 100644
--- a/source4/smbd/server.c
+++ b/source4/smbd/server.c
@@ -46,6 +46,7 @@
 #include "lib/util/tfork.h"
 #include "dsdb/samdb/ldb_modules/util.h"
 #include "lib/util/server_id.h"
+#include "server_util.h"
 
 #ifdef HAVE_PTHREAD
 #include <pthread.h>
@@ -154,6 +155,19 @@ static void sigterm_signal_handler(struct tevent_context *ev,
 	sig_term(SIGTERM);
 }
 
+static void sighup_signal_handler(struct tevent_context *ev,
+				  struct tevent_signal *se,
+				  int signum, int count, void *siginfo,
+				  void *private_data)
+{
+	struct server_state *state = talloc_get_type_abort(
+                private_data, struct server_state);
+
+	DBG_DEBUG("Process %s got SIGHUP\n", state->binary_name);
+
+	reopen_logs_internal();
+}
+
 /*
   setup signal masks
 */
@@ -572,6 +586,7 @@ static int binary_smbd_main(const char *binary_name,
 	};
 	struct server_state *state = NULL;
 	struct tevent_signal *se = NULL;
+	struct samba_tevent_trace_state *samba_tevent_trace_state = NULL;
 
 	setproctitle("root process");
 
@@ -727,6 +742,21 @@ static int binary_smbd_main(const char *binary_name,
 
 	talloc_set_destructor(state->event_ctx, event_ctx_destructor);
 
+	samba_tevent_trace_state = create_samba_tevent_trace_state(state);
+	if (samba_tevent_trace_state == NULL) {
+		exit_daemon("Samba failed to setup tevent tracing state",
+			    ENOTTY);
+		/*
+		 * return is never reached but is here to satisfy static
+		 * checkers
+		 */
+		return 1;
+	}
+
+	tevent_set_trace_callback(state->event_ctx,
+				  samba_tevent_trace_callback,
+				  samba_tevent_trace_state);
+
 	if (opt_interactive) {
 		/* terminate when stdin goes away */
 		stdin_event_flags = TEVENT_FD_READ;
@@ -815,6 +845,22 @@ static int binary_smbd_main(const char *binary_name,
 		return 1;
 	}
 
+	se = tevent_add_signal(state->event_ctx,
+				state->event_ctx,
+				SIGHUP,
+				0,
+				sighup_signal_handler,
+				state);
+	if (se == NULL) {
+		TALLOC_FREE(state);
+		exit_daemon("Initialize SIGHUP handler failed", ENOMEM);
+		/*
+		 * return is never reached but is here to satisfy static
+		 * checkers
+		 */
+		return 1;
+	}
+
 	if (lpcfg_server_role(cmdline_lp_ctx) != ROLE_ACTIVE_DIRECTORY_DC
 	    && !lpcfg_parm_bool(cmdline_lp_ctx, NULL,
 			"server role check", "inhibit", false)
diff --git a/source4/smbd/server_util.c b/source4/smbd/server_util.c
new file mode 100644
index 00000000000..282ad9b17cd
--- /dev/null
+++ b/source4/smbd/server_util.c
@@ -0,0 +1,94 @@
+/*
+   Unix SMB/CIFS implementation.
+
+   Utility routines
+
+   Copyright (C) 2020 Ralph Boehme <slow at samba.org>
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "includes.h"
+#include "lib/tevent/tevent.h"
+#include "lib/util/unix_privs.h"
+#include "server_util.h"
+
+struct samba_tevent_trace_state {
+	size_t events;
+	time_t last_logsize_check;
+};
+
+struct samba_tevent_trace_state *create_samba_tevent_trace_state(
+	TALLOC_CTX *mem_ctx)
+{
+	return talloc_zero(mem_ctx, struct samba_tevent_trace_state);
+}
+
+void samba_tevent_trace_callback(enum tevent_trace_point point,
+				 void *private_data)
+{
+	struct samba_tevent_trace_state *state =
+		talloc_get_type_abort(private_data,
+				      struct samba_tevent_trace_state);
+	time_t now = time(NULL);
+	bool do_check_logs = false;
+	void *priv = NULL;
+
+	switch (point) {
+	case TEVENT_TRACE_BEFORE_WAIT:
+		break;
+	default:
+		return;
+	}
+
+	state->events++;
+
+	/*
+	 * Throttling by some random numbers. smbd uses a similar logic
+	 * checking every 50 SMB requests. Assuming 4 events per request
+	 * we get to the number of 200.
+	 */
+	if ((state->events % 200) == 0) {
+		do_check_logs = true;
+	}
+	/*
+	 * Throttling by some delay, choosing 29 to avoid lockstep with
+	 * the default tevent tickle timer.
+	 */
+	if ((state->last_logsize_check + 29) < now) {
+		do_check_logs = true;
+	}
+
+	if (!do_check_logs) {
+		return;
+	}
+
+	/*
+	 * need_to_check_log_size() checks both the number of messages
+	 * that have been logged and if the logging backend is actually
+	 * going to file. We want to bypass the "number of messages"
+	 * check, so we have to call force_check_log_size() before.
+	 */
+	force_check_log_size();
+	if (!need_to_check_log_size()) {
+		return;
+	}
+
+	priv = root_privileges();
+	check_log_size();
+	TALLOC_FREE(priv);
+
+	state->last_logsize_check = now;
+	return;
+}
diff --git a/source3/winbindd/winbindd_ads.h b/source4/smbd/server_util.h
similarity index 67%
copy from source3/winbindd/winbindd_ads.h
copy to source4/smbd/server_util.h
index 5f121c89e8f..08c09cc67c2 100644
--- a/source3/winbindd/winbindd_ads.h
+++ b/source4/smbd/server_util.h
@@ -1,9 +1,9 @@
 /*
    Unix SMB/CIFS implementation.
 
-   Winbind ADS backend functions
+   Utility routines
 
-   Copyright (C) Volker Lendecke 2017
+   Copyright (C) 2020 Ralph Boehme <slow at samba.org>
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -19,15 +19,15 @@
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 
-#ifndef __WINBINDD_ADS_H__
-#define __WINBINDD_ADS_H__
+#ifndef SAMBA_SERVER_UTIL_H
+#define SAMBA_SERVER_UTIL_H
 
+struct samba_tevent_trace_state;
 
-#include "ads.h"
+struct samba_tevent_trace_state *create_samba_tevent_trace_state(


-- 
Samba Shared Repository


From kseeger at samba.org  Wed Dec  9 08:57:02 2020
From: kseeger at samba.org (Karolin Seeger)
Date: Wed, 09 Dec 2020 08:57:02 +0000
Subject: [SCM] Samba Shared Repository - branch v4-13-test updated
Message-ID: <E1kmvHS-0087HB-1D@hrx0.samba.org>

The branch, v4-13-test has been updated
       via  670c33fe9cb vfs_zfsacl: add missing inherited flag on hidden "magic" everyone@ ACE
       via  67d42392a31 vfs_zfsacl: reformatting
       via  e3d6d452118 s4/samba: call force_check_log_size() in standard_new_task()
       via  db202fc3efc s4/samba: call force_check_log_size() in standard_accept_connection()
       via  f89daf8d255 s4/samba: call force_check_log_size() in prefork_reload_after_fork()
       via  7258fc076ad s4: call reopen_logs_internal() in the SIGHUP handler of the prefork process model
       via  fa2ea13ec04 s4: replace low-level SIGUP handler with a tevent handler
       via  504c6e03018 s4: install tevent tracing hooks to trigger logfile rotation
       via  69a8fb4f971 s4: add samba server tevent trace helper stuff
       via  80401025504 debug: detect logrotation by checking inode number
       via  e7df21ac640 debug: pass struct debug_class *config to do_one_check_log_size()
       via  39efb02c6b4 debug: pass struct debug_class *config to reopen_one_log()
       via  99ea8cd6dfa loadparm: setup debug subsystem setting max_log_size from config
      from  54d3d3cbf49 s3: smbd: Quiet log messages from usershares for an unknown share.

https://git.samba.org/?p=samba.git;a=shortlog;h=v4-13-test


- Log -----------------------------------------------------------------
commit 670c33fe9cbfe033feb785bf82e0540b1d95d762
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Nov 30 12:28:58 2020 +0100

    vfs_zfsacl: add missing inherited flag on hidden "magic" everyone@ ACE
    
    This was an omission in the fixes for bug 14470.
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14587
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>
    
    Autobuild-User(master): Jeremy Allison <jra at samba.org>
    Autobuild-Date(master): Tue Dec  1 20:29:34 UTC 2020 on sn-devel-184
    
    (cherry picked from commit 936f74daed0d6221312f651f35c4ed357bbf1414)
    
    Autobuild-User(v4-13-test): Karolin Seeger <kseeger at samba.org>
    Autobuild-Date(v4-13-test): Wed Dec  9 08:56:47 UTC 2020 on sn-devel-184

commit 67d42392a31781296936f7de74a4622874586084
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Nov 30 12:28:00 2020 +0100

    vfs_zfsacl: reformatting
    
    No change in behaviour.
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14587
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>
    (cherry picked from commit a8457ac3c80e22588e33a343c2306b702734ca88)

commit e3d6d452118389dedbd64f22a2e1f167d24dd45f
Author: Ralph Boehme <slow at samba.org>
Date:   Thu Nov 26 15:24:44 2020 +0100

    s4/samba: call force_check_log_size() in standard_new_task()
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14248
    RN: samba process does not honor max log size
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>
    
    Autobuild-User(master): Jeremy Allison <jra at samba.org>
    Autobuild-Date(master): Mon Dec  7 18:54:29 UTC 2020 on sn-devel-184
    
    (cherry picked from commit 058f96f4c4eda42b404f0067521d3eafb495fe7d)

commit db202fc3efc104bb9ded33931759e506f0523d25
Author: Ralph Boehme <slow at samba.org>
Date:   Thu Nov 26 15:24:26 2020 +0100

    s4/samba: call force_check_log_size() in standard_accept_connection()
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14248
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>
    (cherry picked from commit 6fa5fb8ef26dab862df5c46bb5e74f19839c30e2)

commit f89daf8d25585a22470dfe4ca04157421f8e93cf
Author: Ralph Boehme <slow at samba.org>
Date:   Thu Nov 26 15:23:58 2020 +0100

    s4/samba: call force_check_log_size() in prefork_reload_after_fork()
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14248
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    (cherry picked from commit 82b64e930b0e2d3b2e5186017d9f8e420994136c)

commit 7258fc076adab75d3abeaa874159eb5b04ee5f23
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Nov 23 16:44:04 2020 +0100

    s4: call reopen_logs_internal() in the SIGHUP handler of the prefork process model
    
    With debug_schedule_reopen_logs() the actual reopen only takes place at some
    point in the future when a DEBUG message is processed.
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14248
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>
    (cherry picked from commit 19413e76a46f07fdd46fde5e60707bb6845a782d)

commit fa2ea13ec04c09d1748aad41b27bbcb0c8e056f8
Author: Ralph Boehme <slow at samba.org>
Date:   Fri Nov 20 15:21:03 2020 +0100

    s4: replace low-level SIGUP handler with a tevent handler
    
    Replace the low-level signal handler for SIGHUP with a nice tevent signal
    handler. The low-level handler sig_hup() installed by setup_signals() remains
    being used during early startup before a tevent context is available.
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14248
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>
    (cherry picked from commit 9f71e6173ab43a04804ba8061cb0e8ae6c0165bf)

commit 504c6e03018038aef0fa4753b9e0f315307f4ad1
Author: Ralph Boehme <slow at samba.org>
Date:   Thu Nov 26 14:21:58 2020 +0100

    s4: install tevent tracing hooks to trigger logfile rotation
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14248
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>
    (cherry picked from commit 516c2a04a242a539f9fbddb2822295fee233644c)

commit 69a8fb4f971a87fcb70607fdf4827f64fd806964
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Nov 23 17:53:57 2020 +0100

    s4: add samba server tevent trace helper stuff
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14248
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>
    (backported from commit 68f71f227b17774a12c84575c1eecd82279fac95)
    [slow at samba.org: conflict due to rename source4/smbd/ -> source4/samba/ in master]

commit 80401025504de3c24209f354494b03f95d56ece2
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Nov 23 16:04:03 2020 +0100

    debug: detect logrotation by checking inode number
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14248
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>
    (cherry picked from commit 3651a51e93b45104323d5db1d5ea704d4f71acf1)

commit e7df21ac6408ddde3993bde03b15483db01066a7
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Nov 23 15:51:09 2020 +0100

    debug: pass struct debug_class *config to do_one_check_log_size()
    
    Pass a pointer to the struct instead of all struct members individually. No
    change in behaviour.
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14248
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>
    (cherry picked from commit b7ee36146458bcc2c944f5670b7632df8281ae61)

commit 39efb02c6b49fac0775b9011f82db9d71f6f101f
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Nov 23 15:46:47 2020 +0100

    debug: pass struct debug_class *config to reopen_one_log()
    
    Pass a pointer to the struct instead of all struct members individually. No
    change in behaviour.
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14248
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>
    (cherry picked from commit 29cd139a32d5dbf36bef68eb9c7f1160201e3042)

commit 99ea8cd6dfa2ce30461e9bc9def18e9df6e8bf9f
Author: Ralph Boehme <slow at samba.org>
Date:   Fri Nov 13 12:34:50 2020 +0100

    loadparm: setup debug subsystem setting max_log_size from config
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14248
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>
    (cherry picked from commit ab2c712c016f4e4dacd5064b9eb8f6417f4b9b60)

-----------------------------------------------------------------------

Summary of changes:
 lib/param/loadparm.c                               |  1 +
 lib/util/debug.c                                   | 63 ++++++++++-----
 source3/modules/vfs_zfsacl.c                       |  6 +-
 source4/smbd/process_prefork.c                     | 16 +++-
 source4/smbd/process_standard.c                    |  4 +
 source4/smbd/server.c                              | 46 +++++++++++
 source4/smbd/server_util.c                         | 94 ++++++++++++++++++++++
 .../winbindd_ads.h => source4/smbd/server_util.h   | 18 ++---
 source4/smbd/wscript_build                         |  9 ++-
 9 files changed, 223 insertions(+), 34 deletions(-)
 create mode 100644 source4/smbd/server_util.c
 copy source3/winbindd/winbindd_ads.h => source4/smbd/server_util.h (67%)


Changeset truncated at 500 lines:

diff --git a/lib/param/loadparm.c b/lib/param/loadparm.c
index e041f4fb01b..006caabc092 100644
--- a/lib/param/loadparm.c
+++ b/lib/param/loadparm.c
@@ -3190,6 +3190,7 @@ static bool lpcfg_update(struct loadparm_context *lp_ctx)
 	settings.debug_pid = lp_ctx->globals->debug_pid;
 	settings.debug_uid = lp_ctx->globals->debug_uid;
 	settings.debug_class = lp_ctx->globals->debug_class;
+	settings.max_log_size = lp_ctx->globals->max_log_size;
 	debug_set_settings(&settings, lp_ctx->globals->logging,
 			   lp_ctx->globals->syslog,
 			   lp_ctx->globals->syslog_only);
diff --git a/lib/util/debug.c b/lib/util/debug.c
index 08ffee35a1f..b19c739d4cd 100644
--- a/lib/util/debug.c
+++ b/lib/util/debug.c
@@ -113,6 +113,8 @@ struct debug_class {
 	 */
 	char *logfile;
 	int fd;
+	/* inode number of the logfile to detect logfile rotation */
+	ino_t ino;
 };
 
 static const char *default_classname_table[] = {
@@ -1082,14 +1084,17 @@ static void debug_callback_log(const char *msg, int msg_level)
  Fix from dgibson at linuxcare.com.
 **************************************************************************/
 
-static bool reopen_one_log(int *fd, const char *logfile)
+static bool reopen_one_log(struct debug_class *config)
 {
-	int old_fd = *fd;
+	int old_fd = config->fd;
+	const char *logfile = config->logfile;
+	struct stat st;
 	int new_fd;
+	int ret;
 
 	if (logfile == NULL) {
 		debug_close_fd(old_fd);
-		*fd = -1;
+		config->fd = -1;
 		return true;
 	}
 
@@ -1104,8 +1109,18 @@ static bool reopen_one_log(int *fd, const char *logfile)
 
 	debug_close_fd(old_fd);
 	smb_set_close_on_exec(new_fd);
-	*fd = new_fd;
+	config->fd = new_fd;
 
+	ret = fstat(new_fd, &st);
+	if (ret != 0) {
+		log_overflow = true;
+		DBG_ERR("Unable to fstat() new log file '%s': %s\n",
+			logfile, strerror(errno));
+		log_overflow = false;
+		return false;
+	}
+
+	config->ino = st.st_ino;
 	return true;
 }
 
@@ -1164,8 +1179,7 @@ bool reopen_logs_internal(void)
 	state.reopening_logs = true;
 
 	for (i = DBGC_ALL; i < debug_num_classes; i++) {
-		ok = reopen_one_log(&dbgc_config[i].fd,
-				    dbgc_config[i].logfile);
+		ok = reopen_one_log(&dbgc_config[i]);
 		if (!ok) {
 			break;
 		}
@@ -1249,51 +1263,62 @@ bool need_to_check_log_size(void)
  Check to see if the log has grown to be too big.
  **************************************************************************/
 
-static void do_one_check_log_size(off_t maxlog, int *_fd, const char *logfile)
+static void do_one_check_log_size(off_t maxlog, struct debug_class *config)
 {
-	char name[strlen(logfile) + 5];
+	char name[strlen(config->logfile) + 5];
 	struct stat st;
-	int fd = *_fd;
 	int ret;
+	bool reopen = false;
 	bool ok;
 
 	if (maxlog == 0) {
 		return;
 	}
 
-	ret = fstat(fd, &st);
+	ret = stat(config->logfile, &st);
 	if (ret != 0) {
 		return;
 	}
-	if (st.st_size < maxlog ) {
+	if (st.st_size >= maxlog ) {
+		reopen = true;
+	}
+
+	if (st.st_ino != config->ino) {
+		reopen = true;
+	}
+
+	if (!reopen) {
 		return;
 	}
 
 	/* reopen_logs_internal() modifies *_fd */
 	(void)reopen_logs_internal();
-	fd = *_fd;
 
-	if (fd <= 2) {
+	if (config->fd <= 2) {
 		return;
 	}
-	ret = fstat(fd, &st);
+	ret = fstat(config->fd, &st);
 	if (ret != 0) {
+		config->ino = (ino_t)0;
 		return;
 	}
+
+	config->ino = st.st_ino;
+
 	if (st.st_size < maxlog) {
 		return;
 	}
 
-	snprintf(name, sizeof(name), "%s.old", logfile);
+	snprintf(name, sizeof(name), "%s.old", config->logfile);
 
-	(void)rename(logfile, name);
+	(void)rename(config->logfile, name);
 
 	ok = reopen_logs_internal();
 	if (ok) {
 		return;
 	}
 	/* We failed to reopen a log - continue using the old name. */
-	(void)rename(name, logfile);
+	(void)rename(name, config->logfile);
 }
 
 static void do_check_log_size(off_t maxlog)
@@ -1307,9 +1332,7 @@ static void do_check_log_size(off_t maxlog)
 		if (dbgc_config[i].logfile == NULL) {
 			continue;
 		}
-		do_one_check_log_size(maxlog,
-				      &dbgc_config[i].fd,
-				      dbgc_config[i].logfile);
+		do_one_check_log_size(maxlog, &dbgc_config[i]);
 	}
 }
 
diff --git a/source3/modules/vfs_zfsacl.c b/source3/modules/vfs_zfsacl.c
index 093eb5111e1..fba7253bbef 100644
--- a/source3/modules/vfs_zfsacl.c
+++ b/source3/modules/vfs_zfsacl.c
@@ -219,8 +219,10 @@ static bool zfs_process_smbacl(vfs_handle_struct *handle, files_struct *fsp,
 	}
 	if (must_add_empty_ace) {
 		acebuf[i].a_type = SMB_ACE4_ACCESS_ALLOWED_ACE_TYPE;
-		acebuf[i].a_flags = SMB_ACE4_DIRECTORY_INHERIT_ACE| \
-				    SMB_ACE4_FILE_INHERIT_ACE|ACE_EVERYONE;
+		acebuf[i].a_flags = SMB_ACE4_DIRECTORY_INHERIT_ACE |
+			SMB_ACE4_FILE_INHERIT_ACE |
+			ACE_EVERYONE |
+			ACE_INHERITED_ACE;
 		acebuf[i].a_access_mask = 0;
 		i++;
 	}
diff --git a/source4/smbd/process_prefork.c b/source4/smbd/process_prefork.c
index 3c93fc0ee2a..cc440b84527 100644
--- a/source4/smbd/process_prefork.c
+++ b/source4/smbd/process_prefork.c
@@ -45,6 +45,7 @@
 #include "lib/util/tfork.h"
 #include "lib/messaging/irpc.h"
 #include "lib/util/util_process.h"
+#include "server_util.h"
 
 #define min(a, b) (((a) < (b)) ? (a) : (b))
 
@@ -114,7 +115,7 @@ static void sighup_signal_handler(struct tevent_context *ev,
 				int signum, int count, void *siginfo,
 				void *private_data)
 {
-	debug_schedule_reopen_logs();
+	reopen_logs_internal();
 }
 
 static void sigterm_signal_handler(struct tevent_context *ev,
@@ -154,6 +155,7 @@ static void prefork_reload_after_fork(void)
 	if (!NT_STATUS_IS_OK(status)) {
 		smb_panic("Failed to re-initialise imessaging after fork");
 	}
+	force_check_log_size();
 }
 
 /*
@@ -244,6 +246,7 @@ static void prefork_fork_master(
 	struct tevent_context *ev2;
 	struct task_server *task = NULL;
 	struct process_details pd = initial_process_details;
+	struct samba_tevent_trace_state *samba_tevent_trace_state = NULL;
 	int control_pipe[2];
 
 	t = tfork_create();
@@ -327,6 +330,17 @@ static void prefork_fork_master(
 	 */
 	ev2 = s4_event_context_init(NULL);
 
+	samba_tevent_trace_state = create_samba_tevent_trace_state(ev2);
+	if (samba_tevent_trace_state == NULL) {
+		TALLOC_FREE(ev);
+		TALLOC_FREE(ev2);
+		exit(127);
+	}
+
+	tevent_set_trace_callback(ev2,
+				  samba_tevent_trace_callback,
+				  samba_tevent_trace_state);
+
 	/* setup this new connection: process will bind to it's sockets etc
 	 *
 	 * While we can use ev for the child, which has been re-initialised
diff --git a/source4/smbd/process_standard.c b/source4/smbd/process_standard.c
index 5e804807c93..5af8710d26f 100644
--- a/source4/smbd/process_standard.c
+++ b/source4/smbd/process_standard.c
@@ -408,6 +408,8 @@ static void standard_accept_connection(
 	talloc_free(c);
 	talloc_free(s);
 
+	force_check_log_size();
+
 	/* setup this new connection.  Cluster ID is PID based for this process model */
 	new_conn(ev, lp_ctx, sock2, cluster_id(pid, 0), private_data,
 		 process_context);
@@ -514,6 +516,8 @@ static void standard_new_task(struct tevent_context *ev,
 	 */
 	prctl_set_comment("%s[task]", service_name);
 
+	force_check_log_size();
+
 	/*
 	 * Set up the process context to be passed through to the terminate
 	 * and accept_connection functions
diff --git a/source4/smbd/server.c b/source4/smbd/server.c
index ee2e7508bb3..1e255b1500d 100644
--- a/source4/smbd/server.c
+++ b/source4/smbd/server.c
@@ -46,6 +46,7 @@
 #include "lib/util/tfork.h"
 #include "dsdb/samdb/ldb_modules/util.h"
 #include "lib/util/server_id.h"
+#include "server_util.h"
 
 #ifdef HAVE_PTHREAD
 #include <pthread.h>
@@ -154,6 +155,19 @@ static void sigterm_signal_handler(struct tevent_context *ev,
 	sig_term(SIGTERM);
 }
 
+static void sighup_signal_handler(struct tevent_context *ev,
+				  struct tevent_signal *se,
+				  int signum, int count, void *siginfo,
+				  void *private_data)
+{
+	struct server_state *state = talloc_get_type_abort(
+                private_data, struct server_state);
+
+	DBG_DEBUG("Process %s got SIGHUP\n", state->binary_name);
+
+	reopen_logs_internal();
+}
+
 /*
   setup signal masks
 */
@@ -572,6 +586,7 @@ static int binary_smbd_main(const char *binary_name,
 	};
 	struct server_state *state = NULL;
 	struct tevent_signal *se = NULL;
+	struct samba_tevent_trace_state *samba_tevent_trace_state = NULL;
 
 	setproctitle("root process");
 
@@ -729,6 +744,21 @@ static int binary_smbd_main(const char *binary_name,
 
 	talloc_set_destructor(state->event_ctx, event_ctx_destructor);
 
+	samba_tevent_trace_state = create_samba_tevent_trace_state(state);
+	if (samba_tevent_trace_state == NULL) {
+		exit_daemon("Samba failed to setup tevent tracing state",
+			    ENOTTY);
+		/*
+		 * return is never reached but is here to satisfy static
+		 * checkers
+		 */
+		return 1;
+	}
+
+	tevent_set_trace_callback(state->event_ctx,
+				  samba_tevent_trace_callback,
+				  samba_tevent_trace_state);
+
 	if (opt_interactive) {
 		/* terminate when stdin goes away */
 		stdin_event_flags = TEVENT_FD_READ;
@@ -817,6 +847,22 @@ static int binary_smbd_main(const char *binary_name,
 		return 1;
 	}
 
+	se = tevent_add_signal(state->event_ctx,
+				state->event_ctx,
+				SIGHUP,
+				0,
+				sighup_signal_handler,
+				state);
+	if (se == NULL) {
+		TALLOC_FREE(state);
+		exit_daemon("Initialize SIGHUP handler failed", ENOMEM);
+		/*
+		 * return is never reached but is here to satisfy static
+		 * checkers
+		 */
+		return 1;
+	}
+
 	if (lpcfg_server_role(cmdline_lp_ctx) != ROLE_ACTIVE_DIRECTORY_DC
 	    && !lpcfg_parm_bool(cmdline_lp_ctx, NULL,
 			"server role check", "inhibit", false)
diff --git a/source4/smbd/server_util.c b/source4/smbd/server_util.c
new file mode 100644
index 00000000000..282ad9b17cd
--- /dev/null
+++ b/source4/smbd/server_util.c
@@ -0,0 +1,94 @@
+/*
+   Unix SMB/CIFS implementation.
+
+   Utility routines
+
+   Copyright (C) 2020 Ralph Boehme <slow at samba.org>
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "includes.h"
+#include "lib/tevent/tevent.h"
+#include "lib/util/unix_privs.h"
+#include "server_util.h"
+
+struct samba_tevent_trace_state {
+	size_t events;
+	time_t last_logsize_check;
+};
+
+struct samba_tevent_trace_state *create_samba_tevent_trace_state(
+	TALLOC_CTX *mem_ctx)
+{
+	return talloc_zero(mem_ctx, struct samba_tevent_trace_state);
+}
+
+void samba_tevent_trace_callback(enum tevent_trace_point point,
+				 void *private_data)
+{
+	struct samba_tevent_trace_state *state =
+		talloc_get_type_abort(private_data,
+				      struct samba_tevent_trace_state);
+	time_t now = time(NULL);
+	bool do_check_logs = false;
+	void *priv = NULL;
+
+	switch (point) {
+	case TEVENT_TRACE_BEFORE_WAIT:
+		break;
+	default:
+		return;
+	}
+
+	state->events++;
+
+	/*
+	 * Throttling by some random numbers. smbd uses a similar logic
+	 * checking every 50 SMB requests. Assuming 4 events per request
+	 * we get to the number of 200.
+	 */
+	if ((state->events % 200) == 0) {
+		do_check_logs = true;
+	}
+	/*
+	 * Throttling by some delay, choosing 29 to avoid lockstep with
+	 * the default tevent tickle timer.
+	 */
+	if ((state->last_logsize_check + 29) < now) {
+		do_check_logs = true;
+	}
+
+	if (!do_check_logs) {
+		return;
+	}
+
+	/*
+	 * need_to_check_log_size() checks both the number of messages
+	 * that have been logged and if the logging backend is actually
+	 * going to file. We want to bypass the "number of messages"
+	 * check, so we have to call force_check_log_size() before.
+	 */
+	force_check_log_size();
+	if (!need_to_check_log_size()) {
+		return;
+	}
+
+	priv = root_privileges();
+	check_log_size();
+	TALLOC_FREE(priv);
+
+	state->last_logsize_check = now;
+	return;
+}
diff --git a/source3/winbindd/winbindd_ads.h b/source4/smbd/server_util.h
similarity index 67%
copy from source3/winbindd/winbindd_ads.h
copy to source4/smbd/server_util.h
index 5f121c89e8f..08c09cc67c2 100644
--- a/source3/winbindd/winbindd_ads.h
+++ b/source4/smbd/server_util.h
@@ -1,9 +1,9 @@
 /*
    Unix SMB/CIFS implementation.
 
-   Winbind ADS backend functions
+   Utility routines
 
-   Copyright (C) Volker Lendecke 2017
+   Copyright (C) 2020 Ralph Boehme <slow at samba.org>
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -19,15 +19,15 @@
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 
-#ifndef __WINBINDD_ADS_H__
-#define __WINBINDD_ADS_H__
+#ifndef SAMBA_SERVER_UTIL_H
+#define SAMBA_SERVER_UTIL_H
 
+struct samba_tevent_trace_state;
 
-#include "ads.h"
+struct samba_tevent_trace_state *create_samba_tevent_trace_state(
+	TALLOC_CTX *mem_ctx);
 
-extern struct winbindd_methods ads_methods;
-
-ADS_STATUS ads_idmap_cached_connection(ADS_STRUCT **adsp,
-				       const char *dom_name);
+void samba_tevent_trace_callback(enum tevent_trace_point point,
+				 void *private_data);
 
 #endif
diff --git a/source4/smbd/wscript_build b/source4/smbd/wscript_build
index ef0aaf773c1..14267c1c9a5 100644
--- a/source4/smbd/wscript_build
+++ b/source4/smbd/wscript_build
@@ -17,11 +17,16 @@ bld.SAMBA_LIBRARY('process_model',
                   enabled=bld.AD_DC_BUILD_IS_ENABLED()
                   )
 
+bld.SAMBA_SUBSYSTEM('samba_server_util',
+	            source='server_util.c',
+                    deps='samba-util')
+
 bld.SAMBA_BINARY('samba',
 	source='server.c',
 	subsystem_name='service',
 	deps='''events process_model service samba-hostconfig samba-util POPT_SAMBA
-                popt gensec registry ntvfs share cluster COMMON_SCHANNEL SECRETS''',
+                popt gensec registry ntvfs share cluster COMMON_SCHANNEL SECRETS


-- 
Samba Shared Repository


From jra at samba.org  Fri Dec 11 19:31:01 2020
From: jra at samba.org (Jeremy Allison)
Date: Fri, 11 Dec 2020 19:31:01 +0000
Subject: [SCM] Samba Shared Repository - branch master updated
Message-ID: <E1kno85-00FhFz-Og@hrx0.samba.org>

The branch, master has been updated
       via  49256925996 libsmb: Remove unused ads_dns_query_* routines
       via  d327f664cc1 libsmb: Remove unused dns_lookup_list_async()
       via  9fa3ce29d6b test: test site-aware DC lookup via "net lookup ldap"
       via  b324e2e1a15 net: Use dns_rr_srv->ss_s in "net lookup ldap"
       via  ef8740ce896 net: Use ads_dns_query_srv() in net_lookup_ldap()
       via  61f71f34220 net: Add "sitename" support to "net lookup ldap"
       via  7614cce0bd6 libsmb: No need to call dns_lookup_list_async() in discover_dc_dns()
       via  9d7c048e0b1 libsmb: Use ads_dns_query_srv() in discover_dc_dns()
       via  d92a85fb121 libsmb: No need to call dns_lookup_list_async() in resolve_ads()
       via  b9f91571158 libsmb: Use ads_dns_query_srv() in resolve_ads()
       via  31d85404fc2 libcli: Add ads_dns_query_srv_send()/recv()
       via  60b96580d24 build: Wrap a long line
       via  18128188259 libcli: Add required #includes to dnsquery.h
       via  f25248fe676 libcli: Add required #includes to libcli/dns/dns.h
       via  aec02dc92b9 lib: Make dnsquery.h #ifdef align to our conventions
      from  4fa938e7e5f WHATSNEW: samba-tool gpo manage command

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 49256925996ff5db509364c1c47d0ecd8d79d757
Author: Volker Lendecke <vl at samba.org>
Date:   Sun Nov 29 20:21:21 2020 +0100

    libsmb: Remove unused ads_dns_query_* routines
    
    Signed-off-by: Volker Lendecke <vl at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>
    
    Autobuild-User(master): Jeremy Allison <jra at samba.org>
    Autobuild-Date(master): Fri Dec 11 19:30:16 UTC 2020 on sn-devel-184

commit d327f664cc1e3216afdf3931e2719ba5aa63fce3
Author: Volker Lendecke <vl at samba.org>
Date:   Sun Nov 29 19:34:54 2020 +0100

    libsmb: Remove unused dns_lookup_list_async()
    
    Signed-off-by: Volker Lendecke <vl at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 9fa3ce29d6b6280bb2c3ec6e3e30bbb65dbe6f57
Author: Volker Lendecke <vl at samba.org>
Date:   Fri Dec 4 20:00:28 2020 +0100

    test: test site-aware DC lookup via "net lookup ldap"
    
    Signed-off-by: Volker Lendecke <vl at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit b324e2e1a151f31d8b18298f25098eb77fe18610
Author: Volker Lendecke <vl at samba.org>
Date:   Wed Dec 2 21:18:04 2020 +0100

    net: Use dns_rr_srv->ss_s in "net lookup ldap"
    
    ads_dns_query_srv() always fills it
    
    Signed-off-by: Volker Lendecke <vl at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit ef8740ce89661281c8066583441c16261cd5eaae
Author: Volker Lendecke <vl at samba.org>
Date:   Sun Nov 29 19:17:30 2020 +0100

    net: Use ads_dns_query_srv() in net_lookup_ldap()
    
    Signed-off-by: Volker Lendecke <vl at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 61f71f3422086f4e2a9da85a0320c96d40383686
Author: Volker Lendecke <vl at samba.org>
Date:   Wed Dec 2 21:20:32 2020 +0100

    net: Add "sitename" support to "net lookup ldap"
    
    This will be used in a test later
    
    Signed-off-by: Volker Lendecke <vl at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 7614cce0bd654da7768ba93f50347513dcd95861
Author: Volker Lendecke <vl at samba.org>
Date:   Sun Nov 29 19:32:33 2020 +0100

    libsmb: No need to call dns_lookup_list_async() in discover_dc_dns()
    
    Signed-off-by: Volker Lendecke <vl at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 9d7c048e0b1d74bea1fddd712df882445dc5aecc
Author: Volker Lendecke <vl at samba.org>
Date:   Sun Nov 29 19:13:46 2020 +0100

    libsmb: Use ads_dns_query_srv() in discover_dc_dns()
    
    Signed-off-by: Volker Lendecke <vl at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit d92a85fb12167060bc2373a207fccfb57f9699a8
Author: Volker Lendecke <vl at samba.org>
Date:   Sun Nov 29 19:27:15 2020 +0100

    libsmb: No need to call dns_lookup_list_async() in resolve_ads()
    
    Signed-off-by: Volker Lendecke <vl at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit b9f9157115869f397a8f284b4dda7151c3680281
Author: Volker Lendecke <vl at samba.org>
Date:   Sun Nov 29 19:02:31 2020 +0100

    libsmb: Use ads_dns_query_srv() in resolve_ads()
    
    Signed-off-by: Volker Lendecke <vl at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 31d85404fc2b2e7d4c7d00ac0f8b78e30e3bc089
Author: Volker Lendecke <vl at samba.org>
Date:   Sun Nov 29 18:25:32 2020 +0100

    libcli: Add ads_dns_query_srv_send()/recv()
    
    This issues the "query" for SRV records site-aware and siteless. If
    there are SRV records returned without IP addresses, it will issue A
    and AAAA requests, waiting up to async_dns_timeout seconds. If that
    timeout is reached, ads_dns_query_srv_recv() returns whatever is
    around.
    
    Superdebug added by Jeremy <jra at samba.org> :-)
    
    Signed-off-by: Volker Lendecke <vl at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 60b96580d2415ea8048ea6b216cf764727d23879
Author: Volker Lendecke <vl at samba.org>
Date:   Sun Nov 29 18:04:12 2020 +0100

    build: Wrap a long line
    
    There will be one more .c file
    
    Signed-off-by: Volker Lendecke <vl at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 1812818825947fdbed7d9da343b7759a5eeffaf8
Author: Volker Lendecke <vl at samba.org>
Date:   Sun Nov 29 18:17:10 2020 +0100

    libcli: Add required #includes to dnsquery.h
    
    Signed-off-by: Volker Lendecke <vl at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit f25248fe676591c582d514e8c1a574c3f4b8699c
Author: Volker Lendecke <vl at samba.org>
Date:   Sun Nov 29 18:16:30 2020 +0100

    libcli: Add required #includes to libcli/dns/dns.h
    
    Also, make it safe against being included twice
    
    Signed-off-by: Volker Lendecke <vl at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit aec02dc92b92cd0487562105f7b01e3834550fa6
Author: Volker Lendecke <vl at samba.org>
Date:   Sun Nov 29 17:57:52 2020 +0100

    lib: Make dnsquery.h #ifdef align to our conventions
    
    Signed-off-by: Volker Lendecke <vl at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

-----------------------------------------------------------------------

Summary of changes:
 lib/addns/dnsquery.c                    | 165 ---------
 lib/addns/dnsquery.h                    |  32 +-
 lib/addns/dnsquery_srv.c                | 560 +++++++++++++++++++++++++++++++
 lib/addns/dnsquery_srv.h                |  54 +++
 lib/addns/wscript_build                 |  11 +-
 libcli/dns/dns.h                        |   8 +
 source3/libsmb/dsgetdcname.c            | 200 ++---------
 source3/libsmb/namequery.c              | 575 ++------------------------------
 source3/libsmb/namequery.h              |   6 -
 source3/script/tests/test_net_lookup.sh |  48 +++
 source3/selftest/tests.py               |  12 +
 source3/utils/net_lookup.c              |  62 ++--
 12 files changed, 799 insertions(+), 934 deletions(-)
 create mode 100644 lib/addns/dnsquery_srv.c
 create mode 100644 lib/addns/dnsquery_srv.h
 create mode 100755 source3/script/tests/test_net_lookup.sh


Changeset truncated at 500 lines:

diff --git a/lib/addns/dnsquery.c b/lib/addns/dnsquery.c
index c73ee7b50f1..869d4597ee4 100644
--- a/lib/addns/dnsquery.c
+++ b/lib/addns/dnsquery.c
@@ -780,168 +780,3 @@ fail:
 	return status;
 }
 #endif
-
-/********************************************************************
- Query with optional sitename.
-********************************************************************/
-
-static NTSTATUS ads_dns_query_internal(TALLOC_CTX *ctx,
-				       const char *servicename,
-				       const char *dc_pdc_gc_domains,
-				       const char *realm,
-				       const char *sitename,
-				       struct dns_rr_srv **dclist,
-				       size_t *numdcs )
-{
-	char *name;
-	NTSTATUS status;
-	size_t num_srvs = 0;
-
-	if ((sitename != NULL) && (strlen(sitename) != 0)) {
-		name = talloc_asprintf(ctx, "%s._tcp.%s._sites.%s._msdcs.%s",
-				       servicename, sitename,
-				       dc_pdc_gc_domains, realm);
-		if (name == NULL) {
-			return NT_STATUS_NO_MEMORY;
-		}
-
-		status = ads_dns_lookup_srv(ctx, name, dclist, &num_srvs);
-
-		TALLOC_FREE(name);
-
-		if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
-		    NT_STATUS_EQUAL(status, NT_STATUS_CONNECTION_REFUSED)) {
-			return status;
-		}
-
-		if (NT_STATUS_IS_OK(status) && (num_srvs != 0)) {
-			goto done;
-		}
-	}
-
-	name = talloc_asprintf(ctx, "%s._tcp.%s._msdcs.%s",
-			       servicename, dc_pdc_gc_domains, realm);
-	if (name == NULL) {
-		return NT_STATUS_NO_MEMORY;
-	}
-	status = ads_dns_lookup_srv(ctx, name, dclist, &num_srvs);
-
-done:
-	*numdcs = num_srvs;
-	return status;
-}
-
-/********************************************************************
- Query for AD DC's.
-********************************************************************/
-
-NTSTATUS ads_dns_query_dcs(TALLOC_CTX *ctx,
-			   const char *realm,
-			   const char *sitename,
-			   struct dns_rr_srv **dclist,
-			   size_t *numdcs )
-{
-	NTSTATUS status;
-
-	status = ads_dns_query_internal(ctx,
-					"_ldap",
-					"dc",
-					realm,
-					sitename,
-					dclist,
-					numdcs);
-	return status;
-}
-
-/********************************************************************
- Query for AD GC's.
-********************************************************************/
-
-NTSTATUS ads_dns_query_gcs(TALLOC_CTX *ctx,
-			   const char *realm,
-			   const char *sitename,
-			   struct dns_rr_srv **dclist,
-			   size_t *numdcs )
-{
-	NTSTATUS status;
-
-	status = ads_dns_query_internal(ctx,
-					"_ldap",
-					"gc",
-					realm,
-					sitename,
-					dclist,
-					numdcs);
-	return status;
-}
-
-/********************************************************************
- Query for AD KDC's.
- Even if our underlying kerberos libraries are UDP only, this
- is pretty safe as it's unlikely that a KDC supports TCP and not UDP.
-********************************************************************/
-
-NTSTATUS ads_dns_query_kdcs(TALLOC_CTX *ctx,
-			    const char *dns_forest_name,
-			    const char *sitename,
-			    struct dns_rr_srv **dclist,
-			    size_t *numdcs )
-{
-	NTSTATUS status;
-
-	status = ads_dns_query_internal(ctx,
-					"_kerberos",
-					"dc",
-					dns_forest_name,
-					sitename,
-					dclist,
-					numdcs);
-	return status;
-}
-
-/********************************************************************
- Query for AD PDC. Sitename is obsolete here.
-********************************************************************/
-
-NTSTATUS ads_dns_query_pdc(TALLOC_CTX *ctx,
-			   const char *dns_domain_name,
-			   struct dns_rr_srv **dclist,
-			   size_t *numdcs )
-{
-	return ads_dns_query_internal(ctx,
-				      "_ldap",
-				      "pdc",
-				      dns_domain_name,
-				      NULL,
-				      dclist,
-				      numdcs);
-}
-
-/********************************************************************
- Query for AD DC by guid. Sitename is obsolete here.
-********************************************************************/
-
-NTSTATUS ads_dns_query_dcs_guid(TALLOC_CTX *ctx,
-				const char *dns_forest_name,
-				const char *domain_guid,
-				struct dns_rr_srv **dclist,
-				size_t *numdcs )
-{
-	/*_ldap._tcp.DomainGuid.domains._msdcs.DnsForestName */
-
-	const char *domains;
-
-	/* little hack */
-	domains = talloc_asprintf(ctx, "%s.domains", domain_guid);
-	if (!domains) {
-		return NT_STATUS_NO_MEMORY;
-	}
-
-	return ads_dns_query_internal(ctx,
-				      "_ldap",
-				      domains,
-				      dns_forest_name,
-				      NULL,
-				      dclist,
-				      numdcs);
-}
diff --git a/lib/addns/dnsquery.h b/lib/addns/dnsquery.h
index 777f1a7de6a..51f6b8ff87b 100644
--- a/lib/addns/dnsquery.h
+++ b/lib/addns/dnsquery.h
@@ -17,12 +17,14 @@
  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
-#ifndef _ADS_DNS_H
-#define _ADS_DNS_H
+#ifndef __LIB_ADDNS_DNSQUERY_H__
+#define __LIB_ADDNS_DNSQUERY_H__
 
 #include "replace.h"
 #include <tevent.h>
 #include "libcli/dns/dns.h"
+#include "lib/util/util_net.h"
+#include "libcli/util/ntstatus.h"
 
 /* The following definitions come from libads/dns.c  */
 
@@ -79,28 +81,4 @@ NTSTATUS ads_dns_lookup_aaaa(TALLOC_CTX *ctx,
 			struct samba_sockaddr **addrs_out);
 #endif
 
-NTSTATUS ads_dns_query_dcs(TALLOC_CTX *ctx,
-			   const char *realm,
-			   const char *sitename,
-			   struct dns_rr_srv **dclist,
-			   size_t *numdcs );
-NTSTATUS ads_dns_query_gcs(TALLOC_CTX *ctx,
-			   const char *realm,
-			   const char *sitename,
-			   struct dns_rr_srv **dclist,
-			   size_t *numdcs );
-NTSTATUS ads_dns_query_kdcs(TALLOC_CTX *ctx,
-			    const char *dns_forest_name,
-			    const char *sitename,
-			    struct dns_rr_srv **dclist,
-			    size_t *numdcs );
-NTSTATUS ads_dns_query_pdc(TALLOC_CTX *ctx,
-			   const char *dns_domain_name,
-			   struct dns_rr_srv **dclist,
-			   size_t *numdcs );
-NTSTATUS ads_dns_query_dcs_guid(TALLOC_CTX *ctx,
-				const char *dns_forest_name,
-				const char *domain_guid,
-				struct dns_rr_srv **dclist,
-				size_t *numdcs );
-#endif	/* _ADS_DNS_H */
+#endif	/* __LIB_ADDNS_DNSQUERY_H__ */
diff --git a/lib/addns/dnsquery_srv.c b/lib/addns/dnsquery_srv.c
new file mode 100644
index 00000000000..6cba22f32a2
--- /dev/null
+++ b/lib/addns/dnsquery_srv.c
@@ -0,0 +1,560 @@
+/*
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 3 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "replace.h"
+#include "dnsquery.h"
+#include "dnsquery_srv.h"
+#include "lib/util/debug.h"
+#include "lib/util/tevent_ntstatus.h"
+#include "lib/util/talloc_stack.h"
+#include "lib/util/samba_util.h"
+#include "librpc/gen_ndr/dns.h"
+#include "librpc/ndr/libndr.h"
+
+/*
+ * For an array of dns_rr_srv records, issue A/AAAA queries for those
+ * records where the initial reply did not return IP addresses.
+ */
+
+struct dns_rr_srv_fill_state {
+	struct dns_rr_srv *srvs;
+	size_t num_srvs;
+
+	struct tevent_req **subreqs;
+	size_t num_outstanding;
+};
+
+static void dns_rr_srv_fill_done_a(struct tevent_req *subreq);
+#if defined(HAVE_IPV6)
+static void dns_rr_srv_fill_done_aaaa(struct tevent_req *subreq);
+#endif
+static void dns_rr_srv_fill_timedout(struct tevent_req *subreq);
+
+static struct tevent_req *dns_rr_srv_fill_send(
+	TALLOC_CTX *mem_ctx,
+	struct tevent_context *ev,
+	struct dns_rr_srv *srvs,
+	size_t num_srvs,
+	uint32_t timeout)
+{
+	struct tevent_req *req = NULL, *subreq = NULL;
+	struct dns_rr_srv_fill_state *state = NULL;
+	size_t i, num_subreqs;
+
+	req = tevent_req_create(mem_ctx, &state, struct dns_rr_srv_fill_state);
+	if (req == NULL) {
+		return NULL;
+	}
+	state->srvs = srvs;
+	state->num_srvs = num_srvs;
+
+	/*
+	 * Without IPv6 we only use half of this, but who does not
+	 * have IPv6 these days?
+	 */
+	num_subreqs = num_srvs * 2;
+
+	state->subreqs = talloc_zero_array(
+		state, struct tevent_req *, num_subreqs);
+	if (tevent_req_nomem(state->subreqs, req)) {
+		return tevent_req_post(req, ev);
+	}
+
+	for (i=0; i<num_srvs; i++) {
+
+		if (srvs[i].hostname == NULL) {
+			continue;
+		}
+		if (srvs[i].ss_s != NULL) {
+			/* IP address returned in SRV record. */
+			continue;
+		}
+
+		subreq = ads_dns_lookup_a_send(
+			state->subreqs, ev, srvs[i].hostname);
+		if (tevent_req_nomem(subreq, req)) {
+			TALLOC_FREE(state->subreqs);
+			return tevent_req_post(req, ev);
+		}
+		tevent_req_set_callback(
+			subreq, dns_rr_srv_fill_done_a, req);
+
+		state->subreqs[i*2] = subreq;
+		state->num_outstanding += 1;
+
+#if defined(HAVE_IPV6)
+		subreq = ads_dns_lookup_aaaa_send(
+			state->subreqs, ev, srvs[i].hostname);
+		if (tevent_req_nomem(subreq, req)) {
+			TALLOC_FREE(state->subreqs);
+			return tevent_req_post(req, ev);
+		}
+		tevent_req_set_callback(
+			subreq, dns_rr_srv_fill_done_aaaa, req);
+
+		state->subreqs[i*2+1] = subreq;
+		state->num_outstanding += 1;
+#endif
+	}
+
+	if (state->num_outstanding == 0) {
+		tevent_req_done(req);
+		return tevent_req_post(req, ev);
+	}
+
+	subreq = tevent_wakeup_send(
+		state->subreqs,
+		ev,
+		tevent_timeval_current_ofs(timeout, 0));
+	if (tevent_req_nomem(subreq, req)) {
+		return tevent_req_post(req, ev);
+	}
+	tevent_req_set_callback(subreq, dns_rr_srv_fill_timedout, req);
+
+	return req;
+}
+
+static void dns_rr_srv_fill_done(
+	struct tevent_req *subreq,
+	NTSTATUS (*recv_fn)(
+		struct tevent_req *req,
+		TALLOC_CTX *mem_ctx,
+		uint8_t *rcode_out,
+		size_t *num_names_out,
+		char ***hostnames_out,
+		struct samba_sockaddr **addrs_out))
+{
+	struct tevent_req *req = tevent_req_callback_data(
+		subreq, struct tevent_req);
+	struct dns_rr_srv_fill_state *state = tevent_req_data(
+		req, struct dns_rr_srv_fill_state);
+	size_t num_subreqs = talloc_array_length(state->subreqs);
+	struct dns_rr_srv *srv = NULL;
+	size_t num_ips;
+	struct sockaddr_storage *tmp = NULL;
+	uint8_t rcode = 0;
+	char **hostnames_out = NULL;
+	struct samba_sockaddr *addrs = NULL;
+	size_t num_addrs = 0;
+	NTSTATUS status;
+	size_t i;
+	const char *ip_dbg_str = (recv_fn == ads_dns_lookup_a_recv) ?
+				 "A" : "AAAA";
+
+	/*
+	 * This loop walks all potential subreqs. Typical setups won't
+	 * have more than a few DCs. If you have really many DCs
+	 * (hundreds) and a DNS that doesn't return the DC IPs in the
+	 * SRV reply, you have bigger problems than this loop linearly
+	 * walking a pointer array. This is theoretically O(n^2), but
+	 * probably the DNS roundtrip time outweights this by a
+	 * lot. And we have a global timeout on this whole
+	 * dns_rr_srv_fill routine.
+	 */
+	for (i=0; i<num_subreqs; i++) {
+		if (state->subreqs[i] == subreq) {
+			state->subreqs[i] = NULL;
+			break;
+		}
+	}
+	if (i == num_subreqs) {
+		tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
+		return;
+	}
+
+	srv = &state->srvs[i/2]; /* 2 subreq per srv */
+
+	status = recv_fn(
+		subreq,
+		state,
+		&rcode,
+		&num_addrs,
+		&hostnames_out,
+		&addrs);
+	TALLOC_FREE(subreq);
+
+	if (!NT_STATUS_IS_OK(status)) {
+		DBG_INFO("async DNS %s lookup for %s returned %s\n",
+			 ip_dbg_str,
+			 srv->hostname,
+			 nt_errstr(status));
+		num_addrs = 0;
+		goto done;
+	}
+
+	if (rcode != DNS_RCODE_OK) {
+		DBG_INFO("async DNS %s lookup for %s returned DNS code "
+			 "%"PRIu8"\n",
+			 ip_dbg_str,
+			 srv->hostname,
+			 rcode);
+		num_addrs = 0;
+		goto done;
+	}
+
+	if (num_addrs == 0) {
+		DBG_INFO("async DNS %s lookup for %s returned 0 addresses.\n",
+			 ip_dbg_str,
+			 srv->hostname);
+		goto done;
+	}
+
+	num_ips = talloc_array_length(srv->ss_s);
+
+	if (num_ips + num_addrs < num_addrs) {
+		/* overflow */
+		goto done;
+	}
+
+	tmp = talloc_realloc(
+		state->srvs,
+		srv->ss_s,
+		struct sockaddr_storage,
+		num_ips + num_addrs);
+	if (tmp == NULL) {
+		goto done;
+	}
+
+	for (i=0; i<num_addrs; i++) {
+		char addr[INET6_ADDRSTRLEN];
+		DBG_INFO("async DNS %s lookup for %s [%zu] got %s -> %s\n",
+			 ip_dbg_str,
+			 srv->hostname,
+			 i,
+			 hostnames_out[i],
+			 print_sockaddr(addr, sizeof(addr), &addrs[i].u.ss));
+		tmp[num_ips + i] = addrs[i].u.ss;
+	}
+	srv->ss_s = tmp;
+	srv->num_ips = num_ips + num_addrs;
+
+done:
+	state->num_outstanding -= 1;
+	if (state->num_outstanding == 0) {
+		tevent_req_done(req);
+	}
+}
+
+static void dns_rr_srv_fill_done_a(struct tevent_req *subreq)
+{
+	dns_rr_srv_fill_done(subreq, ads_dns_lookup_a_recv);
+}
+
+#if defined(HAVE_IPV6)
+static void dns_rr_srv_fill_done_aaaa(struct tevent_req *subreq)
+{
+	dns_rr_srv_fill_done(subreq, ads_dns_lookup_aaaa_recv);
+}
+#endif
+
+static void dns_rr_srv_fill_timedout(struct tevent_req *subreq)
+{
+	struct tevent_req *req = tevent_req_callback_data(
+		subreq, struct tevent_req);
+	struct dns_rr_srv_fill_state *state = tevent_req_data(
+		req, struct dns_rr_srv_fill_state);
+	bool ok;
+
+	if (DEBUGLEVEL >= DBGLVL_INFO) {


-- 
Samba Shared Repository


From kseeger at samba.org  Tue Dec 15 12:02:23 2020
From: kseeger at samba.org (Karolin Seeger)
Date: Tue, 15 Dec 2020 12:02:23 +0000
Subject: [SCM] Samba Shared Repository - branch v4-13-test updated
Message-ID: <E1kp927-00GrGZ-T2@hrx0.samba.org>

The branch, v4-13-test has been updated
       via  6f4f529dded VERSION: Bump version up to 4.13.4...
       via  916472aebc9 VERSION: Disable GIT_SNAPSHOT for the 4.13.3 release.
       via  1648eed2470 WHATSNEW: Add release notes for Samba 4.13.3.
      from  670c33fe9cb vfs_zfsacl: add missing inherited flag on hidden "magic" everyone@ ACE

https://git.samba.org/?p=samba.git;a=shortlog;h=v4-13-test


- Log -----------------------------------------------------------------
commit 6f4f529ddedfefae28a4476b33e9e1b556469786
Author: Karolin Seeger <kseeger at samba.org>
Date:   Tue Dec 15 08:51:12 2020 +0100

    VERSION: Bump version up to 4.13.4...
    
    and re-enable GIT_SNAPSHOT.
    
    Signed-off-by: Karolin Seeger <kseeger at samba.org>

commit 916472aebc907c6bc78972e16c5d0557ad215b59
Author: Karolin Seeger <kseeger at samba.org>
Date:   Tue Dec 15 08:50:21 2020 +0100

    VERSION: Disable GIT_SNAPSHOT for the 4.13.3 release.
    
    Signed-off-by: Karolin Seeger <kseeger at samba.org>

commit 1648eed247013464624076e8430fb590d0e32aa7
Author: Karolin Seeger <kseeger at samba.org>
Date:   Tue Dec 15 08:48:59 2020 +0100

    WHATSNEW: Add release notes for Samba 4.13.3.
    
    Signed-off-by: Karolin Seeger <kseeger at samba.org>

-----------------------------------------------------------------------

Summary of changes:
 VERSION      |  2 +-
 WHATSNEW.txt | 75 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++--
 2 files changed, 74 insertions(+), 3 deletions(-)


Changeset truncated at 500 lines:

diff --git a/VERSION b/VERSION
index 3450883b693..567aa29970f 100644
--- a/VERSION
+++ b/VERSION
@@ -25,7 +25,7 @@
 ########################################################
 SAMBA_VERSION_MAJOR=4
 SAMBA_VERSION_MINOR=13
-SAMBA_VERSION_RELEASE=3
+SAMBA_VERSION_RELEASE=4
 
 ########################################################
 # If a official release has a serious bug              #
diff --git a/WHATSNEW.txt b/WHATSNEW.txt
index a3ce5cc3dd5..947fd89e3c3 100644
--- a/WHATSNEW.txt
+++ b/WHATSNEW.txt
@@ -1,3 +1,74 @@
+                   ==============================
+                   Release Notes for Samba 4.13.3
+                          December 15, 2020
+                   ==============================
+
+
+This is the latest stable release of the Samba 4.13 release series.
+
+
+Changes since 4.13.2
+--------------------
+
+o  Jeremy Allison <jra at samba.org>
+   * BUG 14210: libcli: smb2: Never print length if smb2_signing_key_valid()
+     fails for crypto blob.
+   * BUG 14486: s3: modules: gluster. Fix the error I made in preventing talloc
+     leaks from a function. 
+   * BUG 14515: s3: smbd: Don't overwrite contents of fsp->aio_requests[0] with
+     NULL via TALLOC_FREE().
+   * BUG 14568: s3: spoolss: Make parameters in call to user_ok_token() match
+     all other uses.
+   * BUG 14590: s3: smbd: Quiet log messages from usershares for an unknown
+     share.
+
+o  Ralph Boehme <slow at samba.org>
+   * BUG 14248: samba process does not honor max log size.
+   * BUG 14587: vfs_zfsacl: Add missing inherited flag on hidden "magic"
+     everyone@ ACE.
+
+o  Isaac Boukris <iboukris at gmail.com>
+   * BUG 13124: s3-libads: Pass timeout to open_socket_out in ms.
+
+o  G?nther Deschner <gd at samba.org>
+   * BUG 14486: s3-vfs_glusterfs: Always disable write-behind translator.
+
+o  Volker Lendecke <vl at samba.org>
+   * BUG 14517: smbclient: Fix recursive mget.
+   * BUG 14581: clitar: Use do_list()'s recursion in clitar.c.
+
+o  Anoop C S <anoopcs at samba.org>
+   * BUG 14486: manpages/vfs_glusterfs: Mention silent skipping of write-behind
+     translator.
+   * BUG 14573: vfs_shadow_copy2: Preserve all open flags assuming ROFS.
+
+o  Jones Syue <jonessyue at qnap.com>
+   * BUG 14514: interface: Fix if_index is not parsed correctly.
+
+
+#######################################
+Reporting bugs & Development Discussion
+#######################################
+
+Please discuss this release on the samba-technical mailing list or by
+joining the #samba-technical IRC channel on irc.freenode.net.
+
+If you do report problems then please try to send high quality
+feedback. If you don't provide vital information to help us track down
+the problem then you will probably be ignored.  All bug reports should
+be filed under the Samba 4.1 and newer product in the project's Bugzilla
+database (https://bugzilla.samba.org/).
+
+
+======================================================================
+== Our Code, Our Bugs, Our Responsibility.
+== The Samba Team
+======================================================================
+
+
+Release notes for older releases follow:
+----------------------------------------
+
                    ==============================
                    Release Notes for Samba 4.13.2
                           November 03, 2020
@@ -104,8 +175,8 @@ database (https://bugzilla.samba.org/).
 ======================================================================
 
 
-Release notes for older releases follow:
-----------------------------------------
+----------------------------------------------------------------------
+
 
                    ==============================
                    Release Notes for Samba 4.13.1


-- 
Samba Shared Repository


From kseeger at samba.org  Tue Dec 15 12:03:21 2020
From: kseeger at samba.org (Karolin Seeger)
Date: Tue, 15 Dec 2020 12:03:21 +0000
Subject: [SCM] Samba Shared Repository - annotated tag samba-4.13.3 created
Message-ID: <E1kp933-00GrkE-V4@hrx0.samba.org>

The annotated tag, samba-4.13.3 has been created
        at  19255f02b0f0c84e19fea2b10f2e0b149567510d (tag)
   tagging  916472aebc907c6bc78972e16c5d0557ad215b59 (commit)
  replaces  samba-4.13.2
 tagged by  Karolin Seeger
        on  Tue Dec 15 08:54:38 2020 +0100

- Log -----------------------------------------------------------------
samba: tag release samba-4.13.3
-----BEGIN PGP SIGNATURE-----

iF0EABECAB0WIQRS+8C4bZVLCEMyTNxvM5FbZWi36gUCX9hrvgAKCRBvM5FbZWi3
6nHgAJwKtjdGzNaI3nm9WSLBCyMqFjJlbACgjv3dahHSiUF091sXBAck6LWdntc=
=ZImr
-----END PGP SIGNATURE-----

Anoop C S (2):
      vfs_shadow_copy2: Preserve all open flags assuming ROFS
      manpages/vfs_glusterfs: Mention silent skipping of write-behind translator

David Disseldorp (1):
      Revert "vfs_ceph: drop fdopendir handler"

G?nther Deschner (2):
      s3-vfs_glusterfs: always disable write-behind translator
      vfs_glusterfs: print exact cmdline for disabling write-behind translator

Isaac Boukris (1):
      s3-libads: Pass timeout to open_socket_out in ms

Jeremy Allison (6):
      libcli: smb2: Never print length if smb2_signing_key_valid() fails for crypto blob.
      s3: modules: gluster. Fix the error I made in preventing talloc leaks from a function.
      s3: smbd: Don't overwrite contents of fsp->aio_requests[0] with NULL via TALLOC_FREE().
      s3: spoolss: Make parameters in call to user_ok_token() match all other uses.
      s3/script/tests: Ensure all remote test files are removed
      s3: smbd: Quiet log messages from usershares for an unknown share.

Jones Syue (1):
      interface: fix if_index is not parsed correctly

Karolin Seeger (3):
      VERSION: Bump version up to 4.13.3...
      WHATSNEW: Add release notes for Samba 4.13.3.
      VERSION: Disable GIT_SNAPSHOT for the 4.13.3 release.

Noel Power (11):
      s3/script/tests: Fix 'Unrecognized option(s) passed to mkpath()' error
      selftest: Add a new tarmode shares
      s3/script/test: Use different testdir for samba3.blackbox.smbclient_tarmode
      s3/script/tests: Use tarmode share for samba3.blackbox.smbclient_tar*
      s3/script: Use smbclient deltree to clean up smbclient_tarmode subdir
      s3/script/tests: Fix samba3.blackbox.smbclient_tarmode cleanup
      selftest: make samba3.blackbox.smbclient_tar runnable (even manually)
      s3/script/tests: Remove make_path (for remote dir)
      s3/script/tests: Make smb_client 'die' behaviour configurable
      s3/script/tests: call smbclient deltree to remove remote files
      selftest: Remove samba3.blackbox.smbclient_tar from flapping tests

Ralph Boehme (13):
      loadparm: setup debug subsystem setting max_log_size from config
      debug: pass struct debug_class *config to reopen_one_log()
      debug: pass struct debug_class *config to do_one_check_log_size()
      debug: detect logrotation by checking inode number
      s4: add samba server tevent trace helper stuff
      s4: install tevent tracing hooks to trigger logfile rotation
      s4: replace low-level SIGUP handler with a tevent handler
      s4: call reopen_logs_internal() in the SIGHUP handler of the prefork process model
      s4/samba: call force_check_log_size() in prefork_reload_after_fork()
      s4/samba: call force_check_log_size() in standard_accept_connection()
      s4/samba: call force_check_log_size() in standard_new_task()
      vfs_zfsacl: reformatting
      vfs_zfsacl: add missing inherited flag on hidden "magic" everyone@ ACE

Volker Lendecke (5):
      smbclient: Remove the "abort_mget" variable
      smbclient: Slightly simplify do_mget()
      test3: Add a test showing that smbclient recursive mget is broken
      smbclient: Fix recursive mget
      clitar: Use do_list()'s recursion in clitar.c

-----------------------------------------------------------------------


-- 
Samba Shared Repository


From martins at samba.org  Tue Dec 15 12:04:01 2020
From: martins at samba.org (Martin Schwenke)
Date: Tue, 15 Dec 2020 12:04:01 +0000
Subject: [SCM] Samba Shared Repository - branch master updated
Message-ID: <E1kp93h-00Gs8L-AF@hrx0.samba.org>

The branch, master has been updated
       via  6601b3ac544 bootstrap: Update distro list in README.md
       via  1c59f49aaed bootstrap: Cope with case changes in CentOS 8 repo names
      from  49256925996 libsmb: Remove unused ads_dns_query_* routines

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 6601b3ac544244563a8cd3cdb5a4bc7da1b4a759
Author: Martin Schwenke <martin at meltin.net>
Date:   Fri Dec 11 15:57:37 2020 +1100

    bootstrap: Update distro list in README.md
    
    Update examples to make them valid.
    
    Signed-off-by: Martin Schwenke <martin at meltin.net>
    Reviewed-by: Andrew Bartlett <abartlet at samba.org>
    
    Autobuild-User(master): Martin Schwenke <martins at samba.org>
    Autobuild-Date(master): Tue Dec 15 12:03:58 UTC 2020 on sn-devel-184

commit 1c59f49aaede8ec1662d4e49aef84fcd902a8a76
Author: Martin Schwenke <martin at meltin.net>
Date:   Wed Dec 9 00:03:47 2020 +1100

    bootstrap: Cope with case changes in CentOS 8 repo names
    
    RN: Be more flexible with repository names in CentOS 8 test environments
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14594
    Signed-off-by: Martin Schwenke <martin at meltin.net>
    Reviewed-by: Andrew Bartlett <abartlet at samba.org>

-----------------------------------------------------------------------

Summary of changes:
 .gitlab-ci.yml                                 |  2 +-
 bootstrap/README.md                            | 12 ++++++------
 bootstrap/config.py                            |  6 ++++--
 bootstrap/generated-dists/centos8/bootstrap.sh |  6 ++++--
 bootstrap/sha1sum.txt                          |  2 +-
 5 files changed, 16 insertions(+), 12 deletions(-)


Changeset truncated at 500 lines:

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index accaced66a0..7a7582cb6db 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -32,7 +32,7 @@ variables:
   # Set this to the contents of bootstrap/sha1sum.txt
   # which is generated by bootstrap/template.py --render
   #
-  SAMBA_CI_CONTAINER_TAG: 42ecbfbf716fa85ce251a955de72a92af26fc7b2
+  SAMBA_CI_CONTAINER_TAG: c4c00eb35cae36d8d6e752ee01fd943432993721
   #
   # We use the ubuntu1804 image as default as
   # it matches what we have on sn-devel-184.
diff --git a/bootstrap/README.md b/bootstrap/README.md
index d4f30955197..47ef1c67836 100644
--- a/bootstrap/README.md
+++ b/bootstrap/README.md
@@ -12,8 +12,8 @@ A pure python3 module with CLI to bootstrap Samba envs for multiple distribution
 
 ## Supported Distributions
 
-deb: Debian 7|8|9|10, Ubuntu 1404|1604|1804
-rpm: CentOS 6|7, Fedora 28|29, openSUSE Leap 15.0|15.1
+deb: Debian 10, Ubuntu 1604|1804|2004
+rpm: CentOS 7|8, Fedora 32|33, openSUSE Leap 15.1|15.2
 
 Easy to add more.
 
@@ -86,14 +86,14 @@ With Vagrant:
 
  cd bootstrap/generated-dists/
  vagrant up   # start all
- vagrant up debian9  # start one
- vagrant ssh debian9
- vagrant destroy debian9  # destroy one
+ vagrant up debian10  # start one
+ vagrant ssh debian10
+ vagrant destroy debian10  # destroy one
  vagrant destroy  # destroy all
 
 Or a remote/cloud machine:
 
- scp bootstrap/generated-dists/fedora30/bootstrap.sh USER at IP:
+ scp bootstrap/generated-dists/fedora33/bootstrap.sh USER at IP:
  ssh USER at IP
  sudo bash ./bootstrap.sh
 
diff --git a/bootstrap/config.py b/bootstrap/config.py
index 982ebae1cd1..8383aeb392d 100644
--- a/bootstrap/config.py
+++ b/bootstrap/config.py
@@ -235,8 +235,10 @@ yum install -y dnf-plugins-core
 yum install -y epel-release
 
 yum -v repolist all
-yum config-manager --set-enabled PowerTools -y
-yum config-manager --set-enabled Devel -y
+yum config-manager --set-enabled PowerTools -y || \
+    yum config-manager --set-enabled powertools -y
+yum config-manager --set-enabled Devel -y || \
+    yum config-manager --set-enabled devel -y
 yum update -y
 
 yum install -y \
diff --git a/bootstrap/generated-dists/centos8/bootstrap.sh b/bootstrap/generated-dists/centos8/bootstrap.sh
index e5167a2b561..b9f2df67645 100755
--- a/bootstrap/generated-dists/centos8/bootstrap.sh
+++ b/bootstrap/generated-dists/centos8/bootstrap.sh
@@ -12,8 +12,10 @@ yum install -y dnf-plugins-core
 yum install -y epel-release
 
 yum -v repolist all
-yum config-manager --set-enabled PowerTools -y
-yum config-manager --set-enabled Devel -y
+yum config-manager --set-enabled PowerTools -y || \
+    yum config-manager --set-enabled powertools -y
+yum config-manager --set-enabled Devel -y || \
+    yum config-manager --set-enabled devel -y
 yum update -y
 
 yum install -y \
diff --git a/bootstrap/sha1sum.txt b/bootstrap/sha1sum.txt
index 46493c16eb0..3e87c2ed1b0 100644
--- a/bootstrap/sha1sum.txt
+++ b/bootstrap/sha1sum.txt
@@ -1 +1 @@
-42ecbfbf716fa85ce251a955de72a92af26fc7b2
+c4c00eb35cae36d8d6e752ee01fd943432993721


-- 
Samba Shared Repository


From npower at samba.org  Tue Dec 15 15:33:01 2020
From: npower at samba.org (Noel Power)
Date: Tue, 15 Dec 2020 15:33:01 +0000
Subject: [SCM] Samba Shared Repository - branch master updated
Message-ID: <E1kpCJx-005Aoz-Qa@hrx0.samba.org>

The branch, master has been updated
       via  7a077f152aa s3:smbd:trans2.c - add twrp to tmp smb_fname in smbd_do_qfsinfo
       via  9bf9b998088 dbcheck: clarify check_object userparams
       via  83371443898 dbcheck: check_object/userparams: use variable for clarity
       via  22447a51598 dbcheck: reduce useless use of str(attrname)
       via  0dd736ff334 dbcheck: better disambiguate 'attrs'
       via  206a028e1e8 dbcheck: split out attr calculations from check_object()
       via  43530f087de dbcheck: add a helper function for attr tracking
       via  b21287c2f49 dbcheck: do not add duplicate attrs for checking
       via  6b4ff458055 dbcheck: check_object() caches of lower case attr names
       via  25a94fa4743 dbcheck: make rIDSetReferences attr check case-insensitve
      from  6601b3ac544 bootstrap: Update distro list in README.md

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 7a077f152aa3e1e09b4228ae24780fa613540a68
Author: Andrew Walker <awalker at ixsystems.com>
Date:   Tue Dec 8 10:36:10 2020 -0500

    s3:smbd:trans2.c - add twrp to tmp smb_fname in smbd_do_qfsinfo
    
    Preserve VSS-related timestamp in temporary smb_filename before
    calling vfs_stat_fn() in smbd_do_qfsinfo. Otherwise, we can fail
    here on smb2_getinfo requests if file does not exist outside of
    shadow copy path.
    
    Signed-off-by: Andrew Walker <awalker at ixsystems.com>
    Reviewed-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Noel Power <npower at samba.org>
    
    Autobuild-User(master): Noel Power <npower at samba.org>
    Autobuild-Date(master): Tue Dec 15 15:32:18 UTC 2020 on sn-devel-184

commit 9bf9b998088b181955994da2004bf459ef131037
Author: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
Date:   Wed Dec 9 11:50:37 2020 +1300

    dbcheck: clarify check_object userparams
    
    Signed-off-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
    Reviewed-by: Noel Power <npower at samba.org>

commit 83371443898aacdc6033ccf20bc67d4033b96767
Author: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
Date:   Wed Dec 9 11:38:48 2020 +1300

    dbcheck: check_object/userparams: use variable for clarity
    
    Signed-off-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
    Reviewed-by: Noel Power <npower at samba.org>

commit 22447a5159867729559ae47c6fc20159be8f4c25
Author: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
Date:   Wed Dec 9 11:37:48 2020 +1300

    dbcheck: reduce useless use of str(attrname)
    
    it's already a string!
    
    Signed-off-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
    Reviewed-by: Noel Power <npower at samba.org>

commit 0dd736ff3343ce19f2fef3132285d4595aa54afb
Author: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
Date:   Wed Dec 9 11:34:50 2020 +1300

    dbcheck: better disambiguate 'attrs'
    
    We had too many things called 'attrs'; now we have just one, but we
    don't want it to look like it is *the* one.
    
    Signed-off-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
    Reviewed-by: Noel Power <npower at samba.org>

commit 206a028e1e8c83fa1fc2a7b3bbe4a573eb315ff8
Author: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
Date:   Fri Dec 4 13:17:24 2020 +1300

    dbcheck: split out attr calculations from check_object()
    
    check_object is too long!
    
    Signed-off-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
    Reviewed-by: Noel Power <npower at samba.org>

commit 43530f087deab648708508445d4dea160de46889
Author: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
Date:   Fri Dec 4 13:10:49 2020 +1300

    dbcheck: add a helper function for attr tracking
    
    Signed-off-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
    Reviewed-by: Noel Power <npower at samba.org>

commit b21287c2f4922abb76ead510680bd489c6cf3cf9
Author: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
Date:   Fri Dec 4 13:06:25 2020 +1300

    dbcheck: do not add duplicate attrs for checking
    
    Signed-off-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
    Reviewed-by: Noel Power <npower at samba.org>

commit 6b4ff45805550216a47577a2ee2fa04be305fe61
Author: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
Date:   Fri Dec 4 12:57:57 2020 +1300

    dbcheck: check_object() caches of lower case attr names
    
    The construct `'name' in map(str.lower, attrs)` is doubly inefficient,
    because not only is it running the lower() function too often, it is
    searching linearly in a temporary iterator for membership.
    
    So we make a set, and use that.
    
    Signed-off-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
    Reviewed-by: Noel Power <npower at samba.org>

commit 25a94fa4743f4bda9924786775aba43bb8c58c0d
Author: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
Date:   Fri Dec 4 13:56:56 2020 +1300

    dbcheck: make rIDSetReferences attr check case-insensitve
    
    Yes, it looks inefficient, but that's because it is just trying to fit
    in. Very soon we will fix it it properly.
    
    Signed-off-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
    Reviewed-by: Noel Power <npower at samba.org>

-----------------------------------------------------------------------

Summary of changes:
 python/samba/dbchecker.py | 127 +++++++++++++++++++++++++++++-----------------
 source3/smbd/trans2.c     |   7 ++-
 2 files changed, 86 insertions(+), 48 deletions(-)


Changeset truncated at 500 lines:

diff --git a/python/samba/dbchecker.py b/python/samba/dbchecker.py
index 28b56edaafb..364dc9427d7 100644
--- a/python/samba/dbchecker.py
+++ b/python/samba/dbchecker.py
@@ -250,7 +250,7 @@ class dbcheck(object):
 
         for object in res:
             self.dn_set.add(str(object.dn))
-            error_count += self.check_object(object.dn, attrs=attrs)
+            error_count += self.check_object(object.dn, requested_attrs=attrs)
 
         if DN is None:
             error_count += self.check_rootdse()
@@ -2217,27 +2217,38 @@ newSuperior: %s""" % (str(from_dn), str(to_rdn), str(to_base)))
 
         raise KeyError
 
-    def check_object(self, dn, attrs=None):
-        '''check one object'''
-        if self.verbose:
-            self.report("Checking object %s" % dn)
-        if attrs is None:
+    def find_checkable_attrs(self, dn, requested_attrs):
+        """A helper function for check_object() that calculates the list of
+        attributes that need to be checked, and returns that as a list
+        in the original case, and a set normalised to lowercase (for
+        easy existence checks).
+        """
+        if requested_attrs is None:
             attrs = ['*']
         else:
-            # make a local copy to modify
-            attrs = list(attrs)
-        if "dn" in map(str.lower, attrs):
-            attrs.append("name")
-        if "distinguishedname" in map(str.lower, attrs):
-            attrs.append("name")
-        if str(dn.get_rdn_name()).lower() in map(str.lower, attrs):
+            attrs = list(requested_attrs)
+
+        lc_attrs = set(x.lower() for x in attrs)
+
+        def add_attr(a):
+            if a.lower() not in lc_attrs:
+                attrs.append(a)
+                lc_attrs.add(a.lower())
+
+        if ("dn" in lc_attrs or
+            "distinguishedname" in lc_attrs or
+            dn.get_rdn_name().lower() in lc_attrs):
             attrs.append("name")
-        if 'name' in map(str.lower, attrs):
-            attrs.append(dn.get_rdn_name())
-            attrs.append("isDeleted")
-            attrs.append("systemFlags")
+            lc_attrs.add('name')
+
+        if 'name' in lc_attrs:
+            for a in (dn.get_rdn_name(),
+                      "isDeleted",
+                      "systemFlags"):
+                add_attr(a)
+
         need_replPropertyMetaData = False
-        if '*' in attrs:
+        if '*' in lc_attrs:
             need_replPropertyMetaData = True
         else:
             for a in attrs:
@@ -2249,8 +2260,20 @@ newSuperior: %s""" % (str(from_dn), str(to_rdn), str(to_base)))
                 need_replPropertyMetaData = True
                 break
         if need_replPropertyMetaData:
-            attrs.append("replPropertyMetaData")
-        attrs.append("objectGUID")
+            add_attr("replPropertyMetaData")
+
+        add_attr("objectGUID")
+
+        return attrs, lc_attrs
+
+    def check_object(self, dn, requested_attrs=None):
+        '''check one object'''
+        if self.verbose:
+            self.report("Checking object %s" % dn)
+
+        # search attrs are used to find the attributes, lc_attrs are
+        # used for existence checks
+        search_attrs, lc_attrs = self.find_checkable_attrs(dn, requested_attrs)
 
         try:
             sd_flags = 0
@@ -2267,7 +2290,7 @@ newSuperior: %s""" % (str(from_dn), str(to_rdn), str(to_base)))
                                         "sd_flags:1:%d" % sd_flags,
                                         "reveal_internals:0",
                                     ],
-                                    attrs=attrs)
+                                    attrs=search_attrs)
         except ldb.LdbError as e10:
             (enum, estr) = e10.args
             if enum == ldb.ERR_NO_SUCH_OBJECT:
@@ -2302,14 +2325,14 @@ newSuperior: %s""" % (str(from_dn), str(to_rdn), str(to_base)))
         repl_meta_data_val = None
 
         for attrname in obj:
-            if str(attrname).lower() == 'isdeleted':
+            if attrname.lower() == 'isdeleted':
                 if str(obj[attrname][0]) != "FALSE":
                     isDeleted = True
 
-            if str(attrname).lower() == 'systemflags':
+            if attrname.lower() == 'systemflags':
                 systemFlags = int(obj[attrname][0])
 
-            if str(attrname).lower() == 'replpropertymetadata':
+            if attrname.lower() == 'replpropertymetadata':
                 repl_meta_data_val = obj[attrname][0]
 
         if isDeleted and repl_meta_data_val:
@@ -2324,10 +2347,10 @@ newSuperior: %s""" % (str(from_dn), str(to_rdn), str(to_base)))
             if attrname == 'dn' or attrname == "distinguishedName":
                 continue
 
-            if str(attrname).lower() == 'objectclass':
+            if attrname.lower() == 'objectclass':
                 got_objectclass = True
 
-            if str(attrname).lower() == "name":
+            if attrname.lower() == "name":
                 if len(obj[attrname]) != 1:
                     error_count += 1
                     self.report("ERROR: Not fixing num_values(%d) for '%s' on '%s'" %
@@ -2335,7 +2358,7 @@ newSuperior: %s""" % (str(from_dn), str(to_rdn), str(to_base)))
                 else:
                     name_val = str(obj[attrname][0])
 
-            if str(attrname).lower() == str(obj.dn.get_rdn_name()).lower():
+            if attrname.lower() == str(obj.dn.get_rdn_name()).lower():
                 object_rdn_attr = attrname
                 if len(obj[attrname]) != 1:
                     error_count += 1
@@ -2344,7 +2367,7 @@ newSuperior: %s""" % (str(from_dn), str(to_rdn), str(to_base)))
                 else:
                     object_rdn_val = str(obj[attrname][0])
 
-            if str(attrname).lower() == 'replpropertymetadata':
+            if attrname.lower() == 'replpropertymetadata':
                 if self.has_replmetadata_zero_invocationid(dn, obj[attrname][0]):
                     error_count += 1
                     self.err_replmetadata_zero_invocationid(dn, attrname, obj[attrname][0])
@@ -2375,7 +2398,7 @@ newSuperior: %s""" % (str(from_dn), str(to_rdn), str(to_base)))
 
                 continue
 
-            if str(attrname).lower() == 'ntsecuritydescriptor':
+            if attrname.lower() == 'ntsecuritydescriptor':
                 (sd, sd_broken) = self.process_sd(dn, obj)
                 if sd_broken is not None:
                     self.err_wrong_sd(dn, sd, sd_broken)
@@ -2403,7 +2426,7 @@ newSuperior: %s""" % (str(from_dn), str(to_rdn), str(to_base)))
                         continue
                 continue
 
-            if str(attrname).lower() == 'objectclass':
+            if attrname.lower() == 'objectclass':
                 normalised = self.samdb.dsdb_normalise_attributes(self.samdb_schema, attrname, obj[attrname])
                 # Do not consider the attribute incorrect if:
                 #  - The sorted (alphabetically) list is the same, inclding case
@@ -2422,37 +2445,49 @@ newSuperior: %s""" % (str(from_dn), str(to_rdn), str(to_base)))
                     error_count += 1
                 continue
 
-            if str(attrname).lower() == 'userparameters':
-                if len(obj[attrname][0]) == 1 and obj[attrname][0][0] == b'\x20'[0]:
+            if attrname.lower() == 'userparameters':
+                userparams = obj[attrname][0]
+                if userparams == b' ':
                     error_count += 1
                     self.err_short_userParameters(obj, attrname, obj[attrname])
                     continue
 
-                elif obj[attrname][0][:16] == b'\x20\x00\x20\x00\x20\x00\x20\x00\x20\x00\x20\x00\x20\x00\x20\x00':
+                elif userparams[:16] == b'\x20\x00' * 8:
                     # This is the correct, normal prefix
                     continue
 
-                elif obj[attrname][0][:20] == b'IAAgACAAIAAgACAAIAAg':
+                elif userparams[:20] == b'IAAgACAAIAAgACAAIAAg':
                     # this is the typical prefix from a windows migration
                     error_count += 1
                     self.err_base64_userParameters(obj, attrname, obj[attrname])
                     continue
 
                 #43:00:00:00:74:00:00:00:78
-                elif obj[attrname][0][1] != b'\x00'[0] and obj[attrname][0][3] != b'\x00'[0] and obj[attrname][0][5] != b'\x00'[0] and obj[attrname][0][7] != b'\x00'[0] and obj[attrname][0][9] != b'\x00'[0]:
-                    # This is a prefix that is not in UTF-16 format for the space or munged dialback prefix
+                elif (userparams[1] != 0 and
+                      userparams[3] != 0 and
+                      userparams[5] != 0 and
+                      userparams[7] != 0 and
+                      userparams[9] != 0):
+                    # This is a prefix that is not in UTF-16 format
+                    # for the space or munged dialback prefix
                     error_count += 1
                     self.err_utf8_userParameters(obj, attrname, obj[attrname])
                     continue
 
-                elif len(obj[attrname][0]) % 2 != 0:
+                elif len(userparams) % 2 != 0:
                     # This is a value that isn't even in length
                     error_count += 1
                     self.err_odd_userParameters(obj, attrname)
                     continue
 
-                elif obj[attrname][0][1] == b'\x00'[0] and obj[attrname][0][2] == b'\x00'[0] and obj[attrname][0][3] == b'\x00'[0] and obj[attrname][0][4] != b'\x00'[0] and obj[attrname][0][5] == b'\x00'[0]:
-                    # This is a prefix that would happen if a SAMR-written value was replicated from a Samba 4.1 server to a working server
+                elif (userparams[1] == 0 and
+                      userparams[2] == 0 and
+                      userparams[3] == 0 and
+                      userparams[4] != 0 and
+                      userparams[5] == 0):
+                    # This is a prefix that would happen if a
+                    # SAMR-written value was replicated from a Samba
+                    # 4.1 server to a working server
                     error_count += 1
                     self.err_doubled_userParameters(obj, attrname, obj[attrname])
                     continue
@@ -2487,7 +2522,7 @@ newSuperior: %s""" % (str(from_dn), str(to_rdn), str(to_base)))
             if (not flag & dsdb.DS_FLAG_ATTR_NOT_REPLICATED
                 and not flag & dsdb.DS_FLAG_ATTR_IS_CONSTRUCTED
                 and not linkID):
-                set_attrs_seen.add(str(attrname).lower())
+                set_attrs_seen.add(attrname.lower())
 
             if syntax_oid in [dsdb.DSDB_SYNTAX_BINARY_DN, dsdb.DSDB_SYNTAX_OR_NAME,
                               dsdb.DSDB_SYNTAX_STRING_DN, ldb.SYNTAX_DN]:
@@ -2511,17 +2546,17 @@ newSuperior: %s""" % (str(from_dn), str(to_rdn), str(to_base)))
                     error_count += 1
                     break
 
-            if str(attrname).lower() == "instancetype":
+            if attrname.lower() == "instancetype":
                 calculated_instancetype = self.calculate_instancetype(dn)
                 if len(obj["instanceType"]) != 1 or int(obj["instanceType"][0]) != calculated_instancetype:
                     error_count += 1
                     self.err_wrong_instancetype(obj, calculated_instancetype)
 
-        if not got_objectclass and ("*" in attrs or "objectclass" in map(str.lower, attrs)):
+        if not got_objectclass and ("*" in lc_attrs or "objectclass" in lc_attrs):
             error_count += 1
             self.err_missing_objectclass(dn)
 
-        if ("*" in attrs or "name" in map(str.lower, attrs)):
+        if ("*" in lc_attrs or "name" in lc_attrs):
             if name_val is None:
                 error_count += 1
                 self.report("ERROR: Not fixing missing 'name' on '%s'" % (str(obj.dn)))
@@ -2583,7 +2618,7 @@ newSuperior: %s""" % (str(from_dn), str(to_rdn), str(to_base)))
                 self.fix_metadata(obj, att)
 
         if self.is_fsmo_role(dn):
-            if "fSMORoleOwner" not in obj and ("*" in attrs or "fsmoroleowner" in map(str.lower, attrs)):
+            if "fSMORoleOwner" not in obj and ("*" in lc_attrs or "fsmoroleowner" in lc_attrs):
                 self.err_no_fsmoRoleOwner(obj)
                 error_count += 1
 
@@ -2604,7 +2639,7 @@ newSuperior: %s""" % (str(from_dn), str(to_rdn), str(to_base)))
             else:
                 raise
 
-        if dn in self.deleted_objects_containers and '*' in attrs:
+        if dn in self.deleted_objects_containers and '*' in lc_attrs:
             if self.is_deleted_deleted_objects(obj):
                 self.err_deleted_deleted_objects(obj)
                 error_count += 1
@@ -2632,7 +2667,7 @@ newSuperior: %s""" % (str(from_dn), str(to_rdn), str(to_base)))
 
         if dn == self.server_ref_dn:
             # Check we have a valid RID Set
-            if "*" in attrs or "rIDSetReferences" in attrs:
+            if "*" in lc_attrs or "ridsetreferences" in lc_attrs:
                 if "rIDSetReferences" not in obj:
                     # NO RID SET reference
                     # We are RID master, allocate it.
diff --git a/source3/smbd/trans2.c b/source3/smbd/trans2.c
index f6e261ed658..5dac5f0f265 100644
--- a/source3/smbd/trans2.c
+++ b/source3/smbd/trans2.c
@@ -3616,8 +3616,11 @@ NTSTATUS smbd_do_qfsinfo(struct smbXsrv_connection *xconn,
 
 	DEBUG(3,("smbd_do_qfsinfo: level = %d\n", info_level));
 
-	ZERO_STRUCT(smb_fname);
-	smb_fname.base_name = discard_const_p(char, filename);
+	smb_fname = (struct smb_filename) {
+		.base_name = discard_const_p(char, filename),
+		.flags = fname ? fname->flags : 0,
+		.twrp = fname ? fname->twrp : 0,
+	};
 
 	if(info_level != SMB_FS_QUOTA_INFORMATION
 	   && SMB_VFS_STAT(conn, &smb_fname) != 0) {


-- 
Samba Shared Repository


From slow at samba.org  Wed Dec 16 10:16:01 2020
From: slow at samba.org (=?UTF-8?Q?Ralph_B=C3=B6hme?=)
Date: Wed, 16 Dec 2020 10:16:01 +0000
Subject: [SCM] Samba Shared Repository - branch master updated
Message-ID: <E1kpTqj-00C64t-Jg@hrx0.samba.org>

The branch, master has been updated
       via  874c5fcf6da smbd: Remove the smb_fname parameter from set_ea().
       via  898c537a431 smbd: set_ea() must have an fsp, so remove uses of the smb_fname parameter.
       via  0049a34b27f smbd: smb_info_set_ea() can only get fsp==NULL in POSIX mode accessing a symlink.
       via  a55a2bfb914 vfs: SMB_VFS_GET_COMPRESSION() -> SMB_VFS_FGET_COMPRESSION()
       via  3db25c1c9b3 smbd: remove unused get_ea_dos_attribute()
       via  04b4dc8649c vfs: RIP SMB_VFS_GET_DOS_ATTRIBUTES()
       via  d466ba6d613 vfs: add and use fget_ea_dos_attribute()
       via  0f5a28d6c1c smbd: use SMB_VFS_FGET_DOS_ATTRIBUTES() in open_file_ntcreate()
       via  2317583b5e1 smbd: RIP dos_mode()
       via  22d9c31a821 smbd: use fdos_mode() in tsmsm_fset_dos_attributes()
       via  2a1bb23288a smbd: use fdos_mode() in tsmsm_set_dos_attributes()
       via  e7a90fd7a17 smbd: use fdos_mode() in dos_mode_at_vfs_get_dosmode_done()
       via  62d82326a44 smbd: use fdos_mode() in smb_set_file_disposition_info()
       via  8eb561688e1 smbd: use fdos_mode() in smb_set_file_dosmode()
       via  24d75b92d08 smbd: pass fsp to smb_set_file_dosmode()
       via  72d19c89285 smbd: use fdos_mode() in smbd_do_qfilepathinfo()
       via  ccb68c56198 smbd: use fdos_mode() in call_trans2open()
       via  05b31b47b1b smbd: use fdos_mode() in smbd_smb2_create_after_exec()
       via  608085af10d smbd: use fdos_mode() in setup_close_full_information()
       via  0977f13795e smbd: use fdos_mode() in reply_getattrE()
       via  96a882655b8 smbd: use fdos_mode() in copy_file()
       via  812e59c6998 smbd: use fdos_mode() in rename_internals_fsp()
       via  58e103a7916 smbd: README.Coding fixes in rename_internals_fsp()
       via  f19b01a1cbd smbd: use SMB_VFS_FSTAT() in rename_internals_fsp()
       via  8dbac0d5c7a smbd: call rename_open_files() a bit earlier in rename_internals_fsp()
       via  988a838a352 smbd: use fdos_mode() in do_unlink()
       via  7d0c60ffd56 smbd: use fdos_mode() in can_rename()
       via  b3e5feb9ce7 smbd: use fdos_mode() in reply_open_and_X()
       via  594bfdea81b smbd: use fdos_mode() in reply_open()
       via  8bdf3f30fd1 smbd: use fdos_mode() in reply_getatr()
       via  933577585c3 smbd: use fdos_mode() in open_file_ntcreate()
       via  6e5128356ba smbd: use fdos_mode() in check_base_file_access()
       via  7386dc737c0 smbd: use fdos_mode() in copy_internals()
       via  f432bc56801 smbd: use fdos_mode() in call_nt_transact_create()
       via  ec9afe04d81 smbd: use fdos_mode() in reply_ntcreate_and_X()
       via  a649ebed44a smbd: use fdos_mode() in mark_file_modified()
       via  bde16030a29 smbd: use fdos_mode() in vfs_default_durable_reconnect()
       via  147c3f2ef55 smbd: use fdos_mode() in set_create_timespec_ea()
       via  8e9887c24f7 smbd: drop pathref from smb_fname_dst_in in rename_internals_fsp()
       via  ea2def330b1 smbd: un-const smb_fname_dst_in arg of rename_internals_fsp()
       via  c83516f307a vfstest: use filename_convert() in cmd_utime()
       via  54b4321f619 smbd: use fdos_mode() in file_set_sparse()
       via  180e0a7d928 smbd: use fdos_mode() in smbd_dirptr_8_3_mode_fn()
       via  06906b1d1f6 smbd: use fdos_mode() in smbd_dirptr_lanman2_mode_fn()
       via  ccd3352b171 smbd: add fdos_mode()
       via  da93d88e30f vfs_gpfs: fix bogus compiler warning
       via  4ac20da4b91 smbd: use fsp in smb_set_file_time()
       via  ef9afe38d08 smbd: always use check_access_fsp() in smb_set_info_standard()
       via  752bc3881cf smbd: always use check_access_fsp() in smb_set_file_basic_info()
       via  cc0e740ae0f smbd: in reply_setatr() pass pathref fsp to smb_set_file_time()
       via  5bec96219b6 smbd: use check_access_fsp() in set_ea()
       via  a716c5569c7 smbd: use pathref fsp in call_trans2setfilepathinfo()
       via  2bcb268b183 smbd: use pathref fsp in call_trans2qfilepathinfo()
       via  d9e9f063dda smbd: use SMB_VFS_CREATE_FILE() in call_trans2mkdir()
       via  3d8237a8701 smbd: check for non FSA fsps in smb_file_rename_information()
       via  192897b49bb smbd: deal with non FSA fsps in check_access_fsp()
       via  3da8af16146 smbd: unconst fsp arg of check_access_fsp()
       via  9535af3646a smbd: check for valid FSA fsp in smb_set_posix_acl()
       via  1bc943ddf34 smbd: check for valid FSA fsp in smb_query_posix_acl()
       via  435c0f88286 smbd: adjust allocation size check across handles in smbd_do_qfilepathinfo()
       via  2aac91003ee smbd: add smbd_check_access_rights_fsp()
       via  8e3798dd222 smbd: factor out smbd_check_access_rights_sd() from smbd_check_access_rights()
       via  c98d1113f8d smbd: call open_pathref_fsp() in smbd_dirptr_get_entry()
       via  86edc662548 smbd: use get_dosmode in smbd_dirptr_8_3_mode_fn()
       via  36d72d8a81b vfs_default: return stat info for symlinks in POSIX context
       via  dd368479289 vfs_default: simplify vfswrap_readdir()
       via  dba8593c6f8 vfs: Add dirfsp arg to SMB_VFS_READDIR()
       via  985c1be5ccf smbd: use vfs_stat() in more places
       via  37e6783f417 smbd: use vfs_stat() in dptr_ReadDirName()
       via  9d075d80722 smbd: add vfs_stat()
       via  a63a3972948 s3/torture: add POSIX-STAT test
       via  562ae8eb236 s3/torture: add POSIX-READLINK test
       via  c8a2530b8db s3/torture: add POSIX-LS-SINGLE test
       via  0ccd24b41c5 s3/torture: add POSIX-LS-WILDCARD test
       via  626b4e5724e s3/torture: add torture_conn_set_sockopt() wrapper
       via  5770cdd7635 smbd: optimisation using pathref fd to open real fd if possible
       via  37003ec7090 vfs_fruit: disable fd reopening optimisations for the two special macOS streams
       via  4bcb3d7a03d vfs_xattr_tdb: don't leak the fd into the caller
       via  d00d09fdcf7 smbd: reuse smb_fname->fsp in create_file_default()
       via  c21890d128d smbd: replace a stat() with an fstat() in create_file_unixpath()
       via  945bdc7c235 smbd: we DO NEED the low level fd
       via  94dea7a26c2 smbd: call open_pathref_fsp() in unlink_internals() in wildcard matching loop
       via  dab50f39532 smbd: prevent non-POSIX stat-opens of symlinks in open_file()
       via  e6650c47cf0 net: use openat_pathref_fsp() in net_vfs_get_ntacl()
       via  bf4b1b9b12e smbd: avoid a smb_fname copy in smb_set_file_size()
       via  924e7a702f2 smbd: unconst smb_fname arg of all setfileinfo worker functions
       via  83ecda17a20 smbd: use openat_pathref_fsp() in call_trans2findfirst()
       via  aedaa97e694 smbd: un-const smb_fname in get_posix_fsp()
       via  9bdac4f8124 smbd: use openat_pathref_fsp() in copy_file()
       via  492ca5819a4 smbd: use openat_pathref_fsp() rename_internals()
       via  36b03af0ea2 printing: use openat_pathref_fsp() in driver_unlink_internals()
       via  14b0cc6b9a1 smbd: use openat_pathref_fsp() in reply_search()
       via  0bdaba47f4a smbd: use openat_pathref_fsp() in open_streams_for_delete()
       via  e5adfe64fc1 smbd: use openat_pathref_fsp() in get_file_handle_for_metadata()
       via  a74f0af1a91 printing: use openat_pathref_fsp() in get_correct_cversion()
       via  ef5e913bca5 printing: use openat_pathref_fsp() in file_version_is_newer()
       via  cbe25e1777d printing: use openat_pathref_fsp() in file_version_is_newer()
       via  e8a49d0ec9e s3/libadouble: use openat_pathref_fsp() in readdir_attr_meta_finderi_stream()
       via  368b8158cb7 s3/libadouble: use openat_pathref_fsp() in ad_open_rsrc()
       via  e4bb359a53c s3/libadouble: use openat_pathref_fsp() in ad_collect_one_stream()
       via  349c5737734 s3/libadouble: use openat_pathref_fsp() in ad_unconvert_get_streams()
       via  e70c61874af s3/libadouble: use openat_pathref_fsp() in ad_unconvert_open_ad()
       via  be4a4b51169 s3/libadouble: use openat_pathref_fsp() in ad_convert_finderinfo()
       via  67a73548140 s3/libadouble: use openat_pathref_fsp() in ad_convert_xattr()
       via  9a5a1fe148c smbd: use open_pathref_fsp() in filename_convert_internal()
       via  4d29ab04d81 smbd: use common exit in filename_convert_internal()
       via  927c297bd6a smbd: add need_fsa arg and logic to file_find_di_(first|next)
       via  24dd647c1c3 smbd: ignore non FSA fsps in file_find_dif()
       via  05633454f8b smbd: reduce indentation in file_find_dif()
       via  cff6dff5c2a smbd: README.Coding fixes in file_find_dif()
       via  b2685e28d2a smbd: use move_smb_fname_fsp_link() in fsp_set_smb_fname()
       via  d5edf302c9c smbd: maintain correct destructor order in fsp_free()
       via  994f88909df smbd: add move_smb_fname_fsp_link()
       via  d764c183eb5 smbd: add smb_fname_fsp_unlink()
       via  7626bba6c1e smbd: add openat_pathref_fsp()
       via  c1c2dd6c19f smbd: remove SMB_VFS_FSTAT() from open_file()
       via  2b45b9a0900 smbd: always fstat in non_widelink_open()
       via  b6dfcae0cd0 smbd: convert non_widelink_open() and process_symlink_open() to return NTSTATUS
       via  204c7b247b0 smbd: maps NT_STATUS_STOPPED_ON_SYMLINK to NT_STATUS_OBJECT_PATH_NOT_FOUND in open_file()
       via  241dd9d9a74 smbd: pass private_flags to open_file()
       via  12d75a83ea8 smbd: deal with real dirfsps in non_widelink_open()
       via  65c4f615879 smbd: simplify setting and resetting fsp->fsp_name in non_widelink_open()
       via  ade0af78816 smbd: use orig_fsp_name as variable name in non_widelink_open()
       via  d680e9aab16 smbd: remove unused cwdfsp from non_widelink_open()
       via  99f60a74e05 smbd: pass dirfsp down to non_widelink_open() and process_symlink_open()
       via  abc00b959be smbd: pass a dirfsp to fd_open() and rename it to fd_openat()
       via  a272ca549fc smbd: catch O_PATH opens of symlinks in in non_widelink_open()
       via  abb7ab2c10e smbd: already set fsp fd in non_widelink_open()
       via  eb6bbb4f016 smbd: check for pathref fd's in vfs_set_blocking()
       via  f8980821301 vfs_shadow_copy2: deal with real dirfsps in shadow_copy2_openat()
       via  a14db893c19 s3: add full_path_from_dirfsp_atname()
       via  7d1e6e83d8a vfs_glusterfs: implement pathref opens with become_root() fallback
       via  fd8825742f7 vfs_ceph: implement pathref opens in cephwrap_openat()
       via  cf3c48cb088 vfs_default: implement pathref opens in vfswrap_openat()
       via  879d8a3be9f smbd/posix_acls: support pathref fd's in posix_sys_acl_blob_get_fd()
       via  c9889c194aa vfs_posixacl: support pathref fd's in posixacl_sys_acl_set_fd()
       via  b2e6d7b00bc vfs_posixacl: support pathref fd's in posixacl_sys_acl_get_fd()
       via  011252c6111 vfs_fruit: skip Netatalk locking checks for path-ref fd's
       via  9b3c80f8c1c vfs_default: support pathref fd's in vfswrap_fsetxattr()
       via  a46f987ce57 vfs_default: support pathref fd's in vfswrap_fremovexattr()
       via  0f353bca64a vfs_default: support pathref fd's in vfswrap_flistxattr()
       via  3105e53f624 vfs_default: support pathref fd's in vfswrap_fgetxattr()
       via  6d16e580905 vfs_default: initialize conn->have_proc_fds
       via  11e2a8562f8 vfs_default: fix indentation
       via  2af46c7fda6 vfs: add fsp flag "have_proc_fds"
       via  1f94c3ee7be vfs: add struct connection_struct flag "have_proc_fds"
       via  1d35fc7f545 vfs_error_inject: ignore path_ref_fd's
       via  c39940d81b0 s3/lib: add proc fds infrastructure
       via  b56f554ff00 vfs: make struct fd_handle private
       via  dd8fe0cfc26 smbd: remove redundant initialisation of the fsp fd
       via  140df3218a5 smbd: use fd_handle_create()
       via  fdb91631185 smbd: use fh_[get|set]_refcount()
       via  da786ccd1d2 smbd: use fh_[get|set]_private_options()
       via  059dee953d6 smbd: use fh_[get|set]_gen_id()
       via  0d9afd7ab88 smbd: use fh_[get|set]_pos() and fh_[get|set]_position_information()
       via  61628adef65 smbd: use fsp_get_pathref_fd() for logical fd comparisons
       via  450d7f134c7 smbd: use fsp_get_pathref_fd() for fstat() calls
       via  5648662b2f2 smbd: use fsp_get_pathref_fd() for "internal" xattr functions
       via  bc908ea3f2e smbd: use fsp_get_pathref_fd() for *at related directory handles
       via  0208ca6946d smbd: use fsp_get_pathref_fd() when close()ing fds
       via  f5632b43337 smbd: use fsp_get_pathref_fd() as part of DEBUG and syslog messages
       via  9db3ff25732 smbd: use fsp_get_io_fd() when accessing a file or it's associated metadata
       via  50ce980902c smbd: use fsp_set_fd()
       via  28f43fdadc8 smbd: add fd_handle.[c|h]
       via  c6c65d1fc18 vfs: add "is_fsa" flag to struct files_struct
       via  bf7ab87877a vfs: add "is_pathref" to struct files_struct
       via  703c1898034 CI: skip kernel-oplocks tests on older kernels
       via  436903afe2a CI: add samba-no-opath
      from  7a077f152aa s3:smbd:trans2.c - add twrp to tmp smb_fname in smbd_do_qfsinfo

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 874c5fcf6daaa88eddd374f7c8d5162590b046c8
Author: Jeremy Allison <jra at samba.org>
Date:   Mon Dec 14 12:15:48 2020 -0800

    smbd: Remove the smb_fname parameter from set_ea().
    
    We know we must have a valid fsp.
    
    Signed-off-by: Jeremy Allison <jra at samba.org>
    Reviewed-by: Ralph Boehme <slow at samba.org>
    
    Autobuild-User(master): Ralph B?hme <slow at samba.org>
    Autobuild-Date(master): Wed Dec 16 10:15:11 UTC 2020 on sn-devel-184

commit 898c537a4319c1ff657394424475fdaaf2b97ad1
Author: Jeremy Allison <jra at samba.org>
Date:   Mon Dec 14 10:14:46 2020 -0800

    smbd: set_ea() must have an fsp, so remove uses of the smb_fname parameter.
    
    Next we can remove it.
    
    Signed-off-by: Jeremy Allison <jra at samba.org>
    Reviewed-by: Ralph Boehme <slow at samba.org>

commit 0049a34b27f385ef18d4c84c993d1364d4dbbb0f
Author: Jeremy Allison <jra at samba.org>
Date:   Mon Dec 14 12:07:48 2020 -0800

    smbd: smb_info_set_ea() can only get fsp==NULL in POSIX mode accessing a symlink.
    
    Ensure this is the case and force-return NT_STATUS_ACCESS_DENIED here.
    Remove any race condition if anyone modifies the symlink whilst the
    operation is in process.
    
    This now allows us to require a valid fsp for operations on EAs.
    
    Signed-off-by: Jeremy Allison <jra at samba.org>
    Reviewed-by: Ralph Boehme <slow at samba.org>

commit a55a2bfb9143002161ef119298891725c6d3c075
Author: Ralph Boehme <slow at samba.org>
Date:   Tue Oct 13 12:02:34 2020 +0200

    vfs: SMB_VFS_GET_COMPRESSION() -> SMB_VFS_FGET_COMPRESSION()
    
    Now that handle based fdos_mode() is used everywhere we can be sure that we're
    also always getting a handle in SMB_VFS_GET_COMPRESSION() so we can now safely
    remove the path parameter. :)
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 3db25c1c9b3f0d5ec91905b068a0da3daa581e02
Author: Ralph Boehme <slow at samba.org>
Date:   Tue Nov 3 07:57:37 2020 +0100

    smbd: remove unused get_ea_dos_attribute()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 04b4dc8649cecd1699921c9a98f93b64d7c333dc
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Oct 19 21:48:32 2020 +0200

    vfs: RIP SMB_VFS_GET_DOS_ATTRIBUTES()
    
                    (\  _  /)
                    ( \ O / )
                     (// \\)
                        X
                       / \
                      /___\
               _____/      \\_____
              |         +         ||
              |                   ||
              |   SMB_VFS_GET_    ||
              | DOS_ATTRIBUTES()  ||
              |                   ||
              |                   ||
              |                   ||
              |  _     ___   _    ||
              | | \     |   | \   ||
              | |  |    |   |  |  ||
              | |_/     |   |_/   ||
              | | \     |   |     ||
              | |  \    |   |     ||
              | |   \. _|_. | .   ||
              |                   ||
      *     * | *   **    * **    |**     **
       \)),.,\(/.,(//,,..,,\||(,,.,\\,.((//
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit d466ba6d61365f72618dd3093706b8706b8f7c93
Author: Ralph Boehme <slow at samba.org>
Date:   Tue Nov 3 07:57:03 2020 +0100

    vfs: add and use fget_ea_dos_attribute()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 0f5a28d6c1cb564653092c085d51c846ba852183
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Oct 19 21:36:33 2020 +0200

    smbd: use SMB_VFS_FGET_DOS_ATTRIBUTES() in open_file_ntcreate()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 2317583b5e15a0f355f0a04502edf8791a23e8aa
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Oct 19 21:14:41 2020 +0200

    smbd: RIP dos_mode()
    
              .--. .-,       .-..-.__
            .'(`.-` \_.-'-./`  |\_( "\__
         __.>\ ';  _;---,._|   / __/`'--)
        /.--.  : |/' _.--.<|  /  | |
    _..-'    `\     /' /`  /_/ _/_/
     >_.-``-. `Y  /' _;---.`|/))))
    '` .-''. \|:  .'   __, .-'"`
     .'--._ `-:  \/:  /'  '.\             _|_
         /.'`\ :;   /'      `-           `-|-`
        -`    |     |                      |
              :.; : |                  .-'~^~`-.
              |:    |                .' _     _ `.
              |:.   |                | |_) | |_) |
              :. :  |                | | \ | |   |
              : ;   |                |           |
              : ;   |                |           |
              : ;   |                | dos_mode()|
            .:| . : ;                |           |
    -."-/\\\/:::.    `\."-._'."-"_\\-|           |///."-
    " -."-.\\"-."//.-".`-."_\\-.".-\\`=.........=`//-".
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 22d9c31a8210e37e62299f06c2c17df24d615daa
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Oct 19 21:11:51 2020 +0200

    smbd: use fdos_mode() in tsmsm_fset_dos_attributes()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 2a1bb23288a62097d656e7c273e0164fa8bec261
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Oct 19 21:11:19 2020 +0200

    smbd: use fdos_mode() in tsmsm_set_dos_attributes()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit e7a90fd7a173d8e3cd5a2bb163df61758b2b973f
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Oct 19 21:10:40 2020 +0200

    smbd: use fdos_mode() in dos_mode_at_vfs_get_dosmode_done()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 62d82326a442bff55af330acd6917545e307e037
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Oct 19 21:09:00 2020 +0200

    smbd: use fdos_mode() in smb_set_file_disposition_info()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 8eb561688e1ec62a809dc695c0a22179b3c7defd
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Oct 19 21:08:29 2020 +0200

    smbd: use fdos_mode() in smb_set_file_dosmode()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 24d75b92d0839626cd11797e4458494b7a9d6fb2
Author: Ralph Boehme <slow at samba.org>
Date:   Fri Oct 30 22:00:17 2020 +0100

    smbd: pass fsp to smb_set_file_dosmode()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 72d19c89285f27dbfdfc29f3f5e281243156448b
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Oct 19 21:07:35 2020 +0200

    smbd: use fdos_mode() in smbd_do_qfilepathinfo()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit ccb68c56198ce1b135201537565a906a09247a2f
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Oct 19 20:59:35 2020 +0200

    smbd: use fdos_mode() in call_trans2open()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 05b31b47b1b68f3237143b37520d128fda3e2688
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Oct 19 20:59:09 2020 +0200

    smbd: use fdos_mode() in smbd_smb2_create_after_exec()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 608085af10d96547d22ff6b997a5dfdb94d4a830
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Oct 19 20:53:48 2020 +0200

    smbd: use fdos_mode() in setup_close_full_information()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 0977f13795e17a584f64c32f4c4a79f6f00cdcf5
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Oct 19 20:49:02 2020 +0200

    smbd: use fdos_mode() in reply_getattrE()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 96a882655b8e76285f3461ada931fd5a94f2e4a4
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Oct 19 20:48:43 2020 +0200

    smbd: use fdos_mode() in copy_file()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 812e59c6998cd1c6d877087d1feff8b2aebc0f29
Author: Ralph Boehme <slow at samba.org>
Date:   Fri Oct 30 16:08:03 2020 +0100

    smbd: use fdos_mode() in rename_internals_fsp()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 58e103a79161aa4320e6ce64528dbd2669f5ac3b
Author: Ralph Boehme <slow at samba.org>
Date:   Fri Oct 30 16:06:38 2020 +0100

    smbd: README.Coding fixes in rename_internals_fsp()
    
    No change in behaviour.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit f19b01a1cbdb1e2047f4c91647e9c82ed6da6acf
Author: Ralph Boehme <slow at samba.org>
Date:   Fri Oct 30 16:03:19 2020 +0100

    smbd: use SMB_VFS_FSTAT() in rename_internals_fsp()
    
    While at it, use the open handle on the renamed file to call fstat() instead of
    stat().
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 8dbac0d5c7ae3ec3905e0a14069d1c541a230f8e
Author: Ralph Boehme <slow at samba.org>
Date:   Fri Oct 30 15:38:22 2020 +0100

    smbd: call rename_open_files() a bit earlier in rename_internals_fsp()
    
    This prepares for using handle based SMB_VFS_FSTAT() and fdos_mode() a few lines
    below. As some VFS modules will use the fsp->fsp_name we have to make sure to
    rename it first.
    
    Fwiw, notify_rename() is moved as well as it needs to original name in
    fsp->fsp_name.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 988a838a352fe7a47e3b754020ee6887d3ad27be
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Oct 19 20:43:21 2020 +0200

    smbd: use fdos_mode() in do_unlink()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 7d0c60ffd56d80a986c84dabf1b30cb869f8a269
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Oct 19 20:42:41 2020 +0200

    smbd: use fdos_mode() in can_rename()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit b3e5feb9ce73dfce498228a248e4f0dd82b44514
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Oct 19 20:42:03 2020 +0200

    smbd: use fdos_mode() in reply_open_and_X()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 594bfdea81bbf64da0b3eb2dd9aa85c250f1d1f7
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Oct 19 20:41:43 2020 +0200

    smbd: use fdos_mode() in reply_open()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 8bdf3f30fd12b261dc15b101baf1b6350f5c8328
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Oct 19 20:41:18 2020 +0200

    smbd: use fdos_mode() in reply_getatr()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 933577585c3dd48dd17c780babd326dc8160a02b
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Oct 19 20:40:51 2020 +0200

    smbd: use fdos_mode() in open_file_ntcreate()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 6e5128356ba2d7ba325791931448c9c8453a7604
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Oct 19 20:39:37 2020 +0200

    smbd: use fdos_mode() in check_base_file_access()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 7386dc737c047a7a8ee63b42d708d557e14ac08d
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Oct 19 20:38:27 2020 +0200

    smbd: use fdos_mode() in copy_internals()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit f432bc56801f8fd8a3f3f944739550bbd1eb98ee
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Oct 19 20:37:24 2020 +0200

    smbd: use fdos_mode() in call_nt_transact_create()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit ec9afe04d81dc088922dc32b8355e36e28ec5ccf
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Oct 19 20:36:19 2020 +0200

    smbd: use fdos_mode() in reply_ntcreate_and_X()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit a649ebed44a40822b04620fed34e041978628c05
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Oct 19 20:32:49 2020 +0200

    smbd: use fdos_mode() in mark_file_modified()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit bde16030a297e87c81c6b0e5be7b1d93cdd0dd60
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Oct 19 20:32:05 2020 +0200

    smbd: use fdos_mode() in vfs_default_durable_reconnect()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 147c3f2ef55ba8d54539de5c6c5a9c6fb80efd92
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Oct 19 20:31:15 2020 +0200

    smbd: use fdos_mode() in set_create_timespec_ea()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 8e9887c24f7a0706f0e4db5078f5f62845d25fe7
Author: Ralph Boehme <slow at samba.org>
Date:   Thu Oct 29 18:36:08 2020 +0100

    smbd: drop pathref from smb_fname_dst_in in rename_internals_fsp()
    
    The pathref is not needed anymore below this point and it conflicts with the
    code that checks for open handles on the destination just below.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit ea2def330b18d8bfc28f52c80a530a95ba7bd89d
Author: Ralph Boehme <slow at samba.org>
Date:   Thu Oct 29 18:30:19 2020 +0100

    smbd: un-const smb_fname_dst_in arg of rename_internals_fsp()
    
    A subsequent commit is going to modify smb_fname_dst_in.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit c83516f307a9cbcd1663520f772dd1b81119e988
Author: Ralph Boehme <slow at samba.org>
Date:   Wed Oct 28 11:31:46 2020 +0100

    vfstest: use filename_convert() in cmd_utime()
    
    Ensures we have a pathref fsp when calling SMB_VFS_NTIMES().
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 54b4321f6197a82fb0d1fe0263ae950ae9e4379f
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Oct 19 20:29:28 2020 +0200

    smbd: use fdos_mode() in file_set_sparse()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 180e0a7d9282826e56b1b496a6c1cb68e00ed248
Author: Ralph Boehme <slow at samba.org>
Date:   Wed Nov 25 16:35:11 2020 +0100

    smbd: use fdos_mode() in smbd_dirptr_8_3_mode_fn()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 06906b1d1f6b9c98008ac0480f7fb55befc09929
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Oct 19 16:40:18 2020 +0200

    smbd: use fdos_mode() in smbd_dirptr_lanman2_mode_fn()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit ccd3352b171ad4bbe2e4ac1d8030c9dfdd2dac48
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Oct 19 15:44:29 2020 +0200

    smbd: add fdos_mode()
    
    Note that this continues using the braindead dual path/handle based API mistake,
    but only in order to reuse the util functions and because this is an
    intermediate step to support transitioning to an all handle based flow.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit da93d88e30f58d9dfa919982b0625da37c682a27
Author: Ralph Boehme <slow at samba.org>
Date:   Tue Oct 20 21:59:35 2020 +0200

    vfs_gpfs: fix bogus compiler warning
    
    The next commit adds the first call inside Samba to the VFS function
    SMB_VFS_FGET_DOS_ATTRIBUTES() and therefor also to
    vfs_gpfs_fget_dos_attributes().  No idea why gcc is generating this warning:
    
    [4127/4716] Compiling source3/modules/vfs_aio_fork.c
    ../../source3/modules/vfs_gpfs.c: In function ?vfs_gpfs_fget_dos_attributes?:
    ../../source3/modules/vfs_gpfs.c:1728:2: error: ?file_id? may be used uninitialized in this function [-Werror=maybe-uninitialized]
     1728 |  update_stat_ex_file_id(&fsp->fsp_name->st, file_id);
          |  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    compilation terminated due to -Wfatal-errors.
    cc1: all warnings being treated as errors
    
    This change fixes the error.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 4ac20da4b9104fbfb63de09745a89a234441320b
Author: Ralph Boehme <slow at samba.org>
Date:   Wed Oct 28 12:24:14 2020 +0100

    smbd: use fsp in smb_set_file_time()
    
    Ensure we have a valid fsp whos name we pass to file_ntimes(). Remember,
    file_ntimes() by default ends up calling SMB_VFS_GET_DOS_ATTRIBUTES() under the
    hood in order to get/set the creation date.
    
    As any fsp->fsp_name contains a backpointer to the fsp ie
    
      fsp->fsp_name->fsp == fsp
    
    passing set_fsp->fsp_name to file_ntimes() allows replacing the path based
    SMB_VFS_GET_DOS_ATTRIBUTES() with SMB_VFS_FGET_DOS_ATTRIBUTES() under the hoods.
    
    Also use the base_fsp->fsp_name for the base name in case of setting the
    timestamps on a stream.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit ef9afe38d08ab8edddd2f7af3a241dce82cc07a1
Author: Ralph Boehme <slow at samba.org>
Date:   Tue Oct 27 21:13:36 2020 +0100

    smbd: always use check_access_fsp() in smb_set_info_standard()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 752bc3881cfe31b85e38c04564e384a90a354b94
Author: Ralph Boehme <slow at samba.org>
Date:   Tue Oct 27 21:13:12 2020 +0100

    smbd: always use check_access_fsp() in smb_set_file_basic_info()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit cc0e740ae0f739968478161b41379d1f12fb25e2
Author: Ralph Boehme <slow at samba.org>
Date:   Wed Nov 4 10:09:34 2020 +0100

    smbd: in reply_setatr() pass pathref fsp to smb_set_file_time()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 5bec96219b64009fcdd79294c5395cf0cdd79d2d
Author: Ralph Boehme <slow at samba.org>
Date:   Tue Oct 27 21:12:22 2020 +0100

    smbd: use check_access_fsp() in set_ea()
    
    We now always have a fsp.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit a716c5569c76d771d07d1e8172fa31be5fa15b39
Author: Ralph Boehme <slow at samba.org>
Date:   Tue Nov 17 12:14:19 2020 +0100

    smbd: use pathref fsp in call_trans2setfilepathinfo()
    
    This means we're now passing a valid fsp to all setinfo functions. The only
    special case being when dealing with a symlink in POSIX context.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 2bcb268b1837371c9b8a384ca310ac6e54a812d6
Author: Ralph Boehme <slow at samba.org>
Date:   Tue Nov 17 07:54:42 2020 +0100

    smbd: use pathref fsp in call_trans2qfilepathinfo()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit d9e9f063ddaa5465c97d52e8edf25d957b1bddee
Author: Ralph Boehme <slow at samba.org>
Date:   Wed Oct 28 10:35:59 2020 +0100

    smbd: use SMB_VFS_CREATE_FILE() in call_trans2mkdir()
    
    Use SMB_VFS_CREATE_FILE() instead of the create_directory() in order to have a
    fsp that we can pass to set_ea().
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 3d8237a87011ff0ab680fc4c609d7455cf843a0f
Author: Ralph Boehme <slow at samba.org>
Date:   Tue Nov 17 12:11:13 2020 +0100

    smbd: check for non FSA fsps in smb_file_rename_information()
    
    If the fsp is a non FSA fsp created by openat_pathref_fsp(), we can't pass it to
    rename_internals_fsp(). We have to go via rename_internals() which internally
    uses SMB_VFS_CREATE_FILE() to open an fsp which ensure we go through the lease
    checking code.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 192897b49bbaaf3dfb3db00f8c0b16c721d669f8
Author: Ralph Boehme <slow at samba.org>
Date:   Tue Nov 17 12:09:05 2020 +0100

    smbd: deal with non FSA fsps in check_access_fsp()
    
    For fsps coming out of openat_pathref_fsp() and not SMB_VFS_CREATE_FILE(),
    fsp->access_mask will be 0 and we check the requested rights against the
    permissions of the object opened by the fsp.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 3da8af16146b8fb5f73de37013288f947148ed9a
Author: Ralph Boehme <slow at samba.org>
Date:   Tue Nov 17 12:08:48 2020 +0100

    smbd: unconst fsp arg of check_access_fsp()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 9535af3646a3faae48da7dc6cd0e266894b12369
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Nov 16 18:37:42 2020 +0100

    smbd: check for valid FSA fsp in smb_set_posix_acl()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 1bc943ddf34f59af23ab43890e3672cb944491ad
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Nov 16 18:37:11 2020 +0100

    smbd: check for valid FSA fsp in smb_query_posix_acl()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 435c0f88286cffafffd77469b29adcd06abea4e4
Author: Ralph Boehme <slow at samba.org>
Date:   Tue Nov 17 07:59:13 2020 +0100

    smbd: adjust allocation size check across handles in smbd_do_qfilepathinfo()
    
    Check all open files if either we don't have an fsp or if the fsp is not a full
    FSA fsp, ie not one which was created by SMB_VFS_CREATE_FILE() but by
    openat_pathref_fsp().
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 2aac91003ee2212eb25feab6f14d44c7f2759586
Author: Ralph Boehme <slow at samba.org>
Date:   Tue Oct 27 11:24:03 2020 +0100

    smbd: add smbd_check_access_rights_fsp()
    
    Handle based version of smbd_check_access_rights().
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 8e3798dd22276bc1ac8e96004d0e5e974240a7b9
Author: Ralph Boehme <slow at samba.org>
Date:   Tue Oct 27 11:23:03 2020 +0100

    smbd: factor out smbd_check_access_rights_sd() from smbd_check_access_rights()
    
    No change in behaviour.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit c98d1113f8d2cfd52cbe7592574bbe5425a09471
Author: Ralph Boehme <slow at samba.org>
Date:   Thu Nov 12 10:00:57 2020 +0100

    smbd: call open_pathref_fsp() in smbd_dirptr_get_entry()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 86edc662548661761abbe381d35426ba67bd0576
Author: Ralph Boehme <slow at samba.org>
Date:   Wed Nov 25 13:21:25 2020 +0100

    smbd: use get_dosmode in smbd_dirptr_8_3_mode_fn()
    
    Caller currently always passes true, but this will change soonish with a change
    to smbd_dirptr_get_entry().
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 36d72d8a81b9436e067a553d39056de9dc84deec
Author: Ralph Boehme <slow at samba.org>
Date:   Fri Oct 16 15:47:50 2020 +0200

    vfs_default: return stat info for symlinks in POSIX context
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit dd36847928992ee5dc39f09e12992ab65c138923
Author: Ralph Boehme <slow at samba.org>
Date:   Fri Oct 16 15:40:56 2020 +0200

    vfs_default: simplify vfswrap_readdir()
    
    No change in behaviour.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit dba8593c6f8c11d18ddc01e54f90c50c44070257
Author: Ralph Boehme <slow at samba.org>
Date:   Sun Nov 22 13:57:27 2020 +0100

    vfs: Add dirfsp arg to SMB_VFS_READDIR()
    
    This allows for optimisations in VFS module: by passing the dirfsp as an
    additional arg, the function can check fsp->fsp_name->flags which may include eg
    SMB_FILENAME_POSIX_PATH to trigger POSIX pathname processing.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 985c1be5ccf40d0f5c85f42bc0d9bd0a15a86b59
Author: Ralph Boehme <slow at samba.org>
Date:   Wed Nov 25 12:29:40 2020 +0100

    smbd: use vfs_stat() in more places
    
    This replaces the code in a bunch of places where we choose between stat() and
    lstat() based on req->posix_pathname. The new code inside vfs_stat() is based on
    checking the smb_fname flag SMB_FILENAME_POSIX_PATH.
    
    req->posix_pathname is inherited from the global POSIX pathnames state and the
    smb_fname flags is also inherited from that indirectly via the UCF flags.
    
    Tl;dr: no change in behaviour. :)
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 37e6783f417a176b264ef6506174c0bbfe74f405
Author: Ralph Boehme <slow at samba.org>
Date:   Wed Oct 14 15:48:07 2020 +0200

    smbd: use vfs_stat() in dptr_ReadDirName()
    
    This is subtle: we inherit the smb_fname flags from the directory to its
    directory entries while listing a directory. This means if were listing a
    directory in POSIX context, we now treat all entries as POSIX paths and
    correctly call lstat() on the entries instead of stat().
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 9d075d8072210a9806141021c7758575a411ffcf
Author: Ralph Boehme <slow at samba.org>
Date:   Fri Oct 16 14:35:10 2020 +0200

    smbd: add vfs_stat()
    
    Deals with POSIX paths and either calls lstat() for POSIX or stat().
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit a63a39729489be073e0fe882a1f470f82dddfce6
Author: Ralph Boehme <slow at samba.org>
Date:   Thu Oct 15 15:36:42 2020 +0200

    s3/torture: add POSIX-STAT test
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 562ae8eb2369741e96c85fd22a5b65eb8c1863a4
Author: Ralph Boehme <slow at samba.org>
Date:   Thu Oct 15 15:32:34 2020 +0200

    s3/torture: add POSIX-READLINK test
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit c8a2530b8db0e5c9b204577430fe8399bb8ff694
Author: Ralph Boehme <slow at samba.org>
Date:   Thu Oct 15 15:24:11 2020 +0200

    s3/torture: add POSIX-LS-SINGLE test
    
    Note that uses SMB2 for the "Windows client" (aka non-POSIX) connection as SMB1
    directory listing code translates a directory listing with a search mask that
    matches an existing file to a CREATE which won't cut it for our test as we're
    targetting the directory listing code.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 0ccd24b41c5c474435031d6d7bc8abbffb898050
Author: Ralph Boehme <slow at samba.org>
Date:   Thu Oct 15 15:11:20 2020 +0200

    s3/torture: add POSIX-LS-WILDCARD test
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 626b4e5724efe6bde49c112dc31a171854edd180
Author: Ralph Boehme <slow at samba.org>
Date:   Thu Oct 15 12:32:53 2020 +0200

    s3/torture: add torture_conn_set_sockopt() wrapper
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 5770cdd7635a018817418f58bd37268aedebd6a9
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Oct 12 15:28:08 2020 +0200

    smbd: optimisation using pathref fd to open real fd if possible
    
    This is an optimisation that avoids going through the expensive
    non_widelink_open() logic a second time. It depends on a usable /proc/%d/fd/%d
    filesystem and this is checked and set as "can_reopen" flag by the VFS in the
    openat() function in the fsp.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 37003ec709041d523bec56ee17034cc6f3d26a09
Author: Ralph Boehme <slow at samba.org>
Date:   Tue Nov 24 18:02:26 2020 +0100

    vfs_fruit: disable fd reopening optimisations for the two special macOS streams
    
    I couldn't figure out why the reopen fails a few vfs.fruit tests, so for now
    disable the optimisations. It only affects the two special Mac streams, so it's
    not *that* bad, but definitely something we would want to improve on in the near
    future.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 4bcb3d7a03db4c3346bcb4cb62752aa9930cd3b4
Author: Ralph Boehme <slow at samba.org>
Date:   Tue Nov 24 16:16:10 2020 +0100

    vfs_xattr_tdb: don't leak the fd into the caller
    
    This is subtle: generally fsp_set_fd(fd) is called in the caller of
    SMB_VFS_OPENAT() in non_widelink_open().
    
    fsp_set_fd() has a check that asserts certain combindations of the existing
    fsp->fh->fd and the new fd. Both being valid fds is not allowed.
    
    Therefor inside the VFS we must reset fsp->fh->fd if we've set it.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit d00d09fdcf73a5839ae4f82cf8e953bb761bfbfb
Author: Ralph Boehme <slow at samba.org>
Date:   Fri Oct 2 17:40:41 2020 +0200

    smbd: reuse smb_fname->fsp in create_file_default()
    
    This is the big bang for the internal pathref fsps: up to this point the pathref
    fsps were lingering around unused inside smb_fname->fsp.
    
    With this change, the internal fsp will be the one that is going to be returned
    from SMB_VFS_CREATE_FILE() if the client requested access mask matches the
    criteria in open_file():
    
    	uint32_t need_fd_mask =
    		FILE_READ_DATA |
    		FILE_WRITE_DATA |
    		FILE_APPEND_DATA |
    		FILE_EXECUTE |
    		WRITE_DAC_ACCESS |
    		WRITE_OWNER_ACCESS |
    		SEC_FLAG_SYSTEM_SECURITY |
    		READ_CONTROL_ACCESS;
    
    As long as the client doesn't request any of the access rights listed above, we
    reuse the smb_fname->fsp, otherwise we close the smb_fname->fsp and call
    fd_open() to open a new fsp.
    
    In the future we can remove the four non-IO related access rights from the list:
    
    		WRITE_DAC_ACCESS |
    		WRITE_OWNER_ACCESS |
    		SEC_FLAG_SYSTEM_SECURITY |
    		READ_CONTROL_ACCESS
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit c21890d128d43f6f739051aff61436c9119ba5ab
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Nov 23 07:46:42 2020 +0100

    smbd: replace a stat() with an fstat() in create_file_unixpath()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 945bdc7c2350ba2edc6fd40bfcf2d5ac3f451b5c
Author: Ralph Boehme <slow at samba.org>
Date:   Tue Oct 27 19:21:48 2020 +0100

    smbd: we DO NEED the low level fd
    
    In order to make everything handle based, we will need the basefile handle when
    eg the client requests setting any of the filemetadata that is common across all
    streams, eg the file's timestamps.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 94dea7a26c2f4cd4e7ca0a6913cbcbb4b0e6e881
Author: Ralph Boehme <slow at samba.org>
Date:   Fri Jul 17 19:35:50 2020 +0200

    smbd: call open_pathref_fsp() in unlink_internals() in wildcard matching loop
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit dab50f3953259635ba14d166472c3dbe920f1311
Author: Ralph Boehme <slow at samba.org>
Date:   Thu Oct 1 14:40:33 2020 +0200

    smbd: prevent non-POSIX stat-opens of symlinks in open_file()
    
    Also adjust the test that checks for this.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit e6650c47cf08dc9c95668cd321cc66267318125a
Author: Ralph Boehme <slow at samba.org>
Date:   Thu Nov 12 16:54:28 2020 +0100

    net: use openat_pathref_fsp() in net_vfs_get_ntacl()
    
    Ensures we have a pathref handle in the smb_fname we pass to
    SMB_VFS_CREATE_FILE().
    
    As the create_disposition is FILE_OPEN we just return the error if
    openat_pathref_fsp() fails
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit bf4b1b9b12ec82a0d5b20586e961f8fe6ecf89b2
Author: Ralph Boehme <slow at samba.org>
Date:   Thu Nov 12 16:51:26 2020 +0100

    smbd: avoid a smb_fname copy in smb_set_file_size()
    
    Now that we get a non-const smb_fname we can use that for the call to
    SMB_VFS_CREATE_FILE().
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 924e7a702f2b9dae563b10969864a2085418be2b
Author: Ralph Boehme <slow at samba.org>
Date:   Thu Nov 12 16:28:41 2020 +0100

    smbd: unconst smb_fname arg of all setfileinfo worker functions
    
    This allows avoiding making copies of the smb_fname when it needs to be passed
    to a function that takes a non-const smb_fname.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 83ecda17a20cf25696698cb7693cea509a642575
Author: Ralph Boehme <slow at samba.org>
Date:   Thu Nov 12 15:51:59 2020 +0100

    smbd: use openat_pathref_fsp() in call_trans2findfirst()
    
    Ensures we have a pathref handle in the smb_fname we pass to
    SMB_VFS_CREATE_FILE().
    
    Also drop pathref fsp from filename_convert() in call_trans2findfirst(), because
    the call to filename_convert() is on the path from the client including the
    search mask.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit aedaa97e6942bc76af53fb4535183a574a0e4cac
Author: Ralph Boehme <slow at samba.org>
Date:   Thu Nov 12 15:48:15 2020 +0100

    smbd: un-const smb_fname in get_posix_fsp()
    
    Avoids making a copy of smb_fname which allows using smb_fname->fsp if there is
    one.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 9bdac4f81242d69fc75705614dbe69cddc7667c4
Author: Ralph Boehme <slow at samba.org>
Date:   Thu Nov 12 15:46:57 2020 +0100

    smbd: use openat_pathref_fsp() in copy_file()
    
    Ensures we have a pathref handle in the smb_fname we pass to
    SMB_VFS_CREATE_FILE().
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 492ca5819a40f06d59d670d39c98271b223a5a55
Author: Ralph Boehme <slow at samba.org>
Date:   Thu Nov 12 15:44:08 2020 +0100

    smbd: use openat_pathref_fsp() rename_internals()
    
    Ensures we have a pathref handle in the smb_fname we pass to
    SMB_VFS_CREATE_FILE().
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 36b03af0ea25ca5f390fcc597ff258e1662d1536
Author: Ralph Boehme <slow at samba.org>
Date:   Thu Nov 12 14:57:45 2020 +0100

    printing: use openat_pathref_fsp() in driver_unlink_internals()
    
    Ensures we have a pathref handle in the smb_fname we pass to
    SMB_VFS_CREATE_FILE().
    
    As the create_disposition is FILE_OPEN we just return the error if
    openat_pathref_fsp() fails
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 14b0cc6b9a1027b4d6d95be58d05f72e375d9f56
Author: Ralph Boehme <slow at samba.org>
Date:   Thu Nov 12 14:52:31 2020 +0100

    smbd: use openat_pathref_fsp() in reply_search()
    
    Ensures we have a pathref handle in the smb_fname we pass to
    SMB_VFS_CREATE_FILE().
    
    As the create_disposition is FILE_OPEN we just return the error if
    openat_pathref_fsp() fails
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 0bdaba47f4a6cfef6740fda84f983bf316562ed2
Author: Ralph Boehme <slow at samba.org>
Date:   Thu Nov 12 12:56:56 2020 +0100

    smbd: use openat_pathref_fsp() in open_streams_for_delete()
    
    Ensures we have a pathref handle in the smb_fname we pass to
    SMB_VFS_CREATE_FILE().
    
    As the create_disposition is FILE_OPEN we just return the error if
    openat_pathref_fsp() fails
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit e5adfe64fc116defaba0aea376f81a31b70e1e4d
Author: Ralph Boehme <slow at samba.org>
Date:   Thu Nov 12 12:51:04 2020 +0100

    smbd: use openat_pathref_fsp() in get_file_handle_for_metadata()
    
    Ensures we have a pathref handle in the smb_fname we pass to
    SMB_VFS_CREATE_FILE().
    
    As the create_disposition is FILE_OPEN we just return the error if
    openat_pathref_fsp() fails
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit a74f0af1a91fe0bbc68e4d41d65f43ec383ae8bf
Author: Ralph Boehme <slow at samba.org>
Date:   Thu Nov 12 12:47:19 2020 +0100

    printing: use openat_pathref_fsp() in get_correct_cversion()
    
    Ensures we have a pathref handle in the smb_fname we pass to
    SMB_VFS_CREATE_FILE().
    
    As the create_disposition is FILE_OPEN we just return the error if
    openat_pathref_fsp() fails
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit ef5e913bca584f0232d5bfff14df4ccba2dda35c
Author: Ralph Boehme <slow at samba.org>
Date:   Thu Nov 12 12:39:29 2020 +0100

    printing: use openat_pathref_fsp() in file_version_is_newer()
    
    Ensures we have a pathref handle in the smb_fname we pass to
    SMB_VFS_CREATE_FILE().
    
    As the create_disposition is FILE_OPEN we just return the error if
    openat_pathref_fsp() fails
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit cbe25e1777d0c43c21e8acc2cea79fd03fdaf2ea
Author: Ralph Boehme <slow at samba.org>
Date:   Thu Nov 12 12:38:43 2020 +0100

    printing: use openat_pathref_fsp() in file_version_is_newer()
    
    Ensures we have a pathref handle in the smb_fname we pass to
    SMB_VFS_CREATE_FILE().
    
    As the create_disposition is FILE_OPEN we just return the error if
    openat_pathref_fsp() fails
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit e8a49d0ec9e4fc31e1b2a8f93a3d36b2a3caed50
Author: Ralph Boehme <slow at samba.org>
Date:   Thu Nov 12 12:37:52 2020 +0100

    s3/libadouble: use openat_pathref_fsp() in readdir_attr_meta_finderi_stream()
    
    Ensures we have a pathref handle in the smb_fname we pass to
    SMB_VFS_CREATE_FILE().
    
    As the create_disposition is FILE_OPEN we just return the error if
    openat_pathref_fsp() fails
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 368b8158cb737089fb471019de4bfadf5c0d57e2
Author: Ralph Boehme <slow at samba.org>
Date:   Thu Nov 12 12:34:21 2020 +0100

    s3/libadouble: use openat_pathref_fsp() in ad_open_rsrc()
    
    Ensures we have a pathref handle in the smb_fname we pass to
    SMB_VFS_CREATE_FILE().
    
    As the create_disposition is FILE_OPEN we just return the error if
    openat_pathref_fsp() fails
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit e4bb359a53c64bf2622def547dfc3520d1b5cd67
Author: Ralph Boehme <slow at samba.org>
Date:   Thu Nov 12 12:32:02 2020 +0100

    s3/libadouble: use openat_pathref_fsp() in ad_collect_one_stream()
    
    Ensures we have a pathref handle in the smb_fname we pass to
    SMB_VFS_CREATE_FILE().
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 349c5737734788b4d2725387405b7b4ffd8a6d9a
Author: Ralph Boehme <slow at samba.org>
Date:   Thu Nov 12 12:31:13 2020 +0100

    s3/libadouble: use openat_pathref_fsp() in ad_unconvert_get_streams()
    
    Ensures we have a pathref handle in the smb_fname we pass to
    SMB_VFS_CREATE_FILE().
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit e70c61874aff29176712274ebf1e721b0d339910
Author: Ralph Boehme <slow at samba.org>
Date:   Thu Nov 12 12:30:18 2020 +0100

    s3/libadouble: use openat_pathref_fsp() in ad_unconvert_open_ad()
    
    Ensures we have a pathref handle in the smb_fname we pass to
    SMB_VFS_CREATE_FILE().
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit be4a4b511693c75165e7ead599f8652e70ec0155
Author: Ralph Boehme <slow at samba.org>
Date:   Thu Nov 12 12:28:30 2020 +0100

    s3/libadouble: use openat_pathref_fsp() in ad_convert_finderinfo()
    
    Ensures we have a pathref handle in the smb_fname we pass to
    SMB_VFS_CREATE_FILE().
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 67a73548140b5134a0389e47ad169805ea970641
Author: Ralph Boehme <slow at samba.org>
Date:   Thu Nov 12 12:25:56 2020 +0100

    s3/libadouble: use openat_pathref_fsp() in ad_convert_xattr()
    
    Ensures we have a pathref handle in the smb_fname we pass to
    SMB_VFS_CREATE_FILE().
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 9a5a1fe148cd82cd00d2ee913ec1ae90b9fb24e0
Author: Ralph Boehme <slow at samba.org>
Date:   Sat Jun 13 19:16:39 2020 +0200

    smbd: use open_pathref_fsp() in filename_convert_internal()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 4d29ab04d810fa05140b347928872185ae54fff6
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Nov 23 06:40:16 2020 +0100

    smbd: use common exit in filename_convert_internal()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 927c297bd6af116758cfb5081523859e0156834d
Author: Ralph Boehme <slow at samba.org>
Date:   Thu Nov 19 11:35:23 2020 +0100

    smbd: add need_fsa arg and logic to file_find_di_(first|next)
    
    All callers except rename_open_files() can ignore non FSA fsps.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 24dd647c1c34dc5b09f55f03aef4725c06a185ab
Author: Ralph Boehme <slow at samba.org>
Date:   Thu Nov 19 11:21:42 2020 +0100

    smbd: ignore non FSA fsps in file_find_dif()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 05633454f8babf74ee615bd015805ce1e2d96997
Author: Ralph Boehme <slow at samba.org>
Date:   Thu Nov 19 11:10:35 2020 +0100

    smbd: reduce indentation in file_find_dif()
    
    No change in behaviour.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit cff6dff5c2a730bfb4915aa1182c0421e5db680f
Author: Ralph Boehme <slow at samba.org>
Date:   Thu Nov 19 11:09:05 2020 +0100

    smbd: README.Coding fixes in file_find_dif()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit b2685e28d2ab6b7b68db2bd1f615a848663d5eb5
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Nov 23 06:23:12 2020 +0100

    smbd: use move_smb_fname_fsp_link() in fsp_set_smb_fname()
    
    This ensures that fsp->fsp_name->fsp is again set to the fsp and also preserves
    the link fsp->fsp_name->fsp_link.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit d5edf302c9ca1a48927c8a6db780b8e193edfd05
Author: Ralph Boehme <slow at samba.org>
Date:   Wed Jun 10 15:21:35 2020 +0200

    smbd: maintain correct destructor order in fsp_free()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 994f88909dfb7bde4381d547d37f4422ed3d77e2
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Nov 23 06:00:40 2020 +0100

    smbd: add move_smb_fname_fsp_link()
    
    Function to move fsps from one smb_fname to another.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit d764c183eb5704064fdcbeb2903fba06a1481d37
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Nov 23 05:59:02 2020 +0100

    smbd: add smb_fname_fsp_unlink()
    
    Remove the link between an smb_fname and it's embedded smb_fname->fsp.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 7626bba6c1efaeb457d43e8821572f45f6b344ab
Author: Ralph Boehme <slow at samba.org>
Date:   Tue Sep 29 10:14:47 2020 +0200

    smbd: add openat_pathref_fsp()
    
    open_pathref_fsp() opens an "embedded" fsp inside smb_fname as
    smb_fname->fsp. We call such an fsp a "pathref" fsp.
    
    On system that support O_PATH the low level openat() is done with O_PATH. On
    systems that lack support for O_PATH, we impersonate the root user as a
    fallback.
    
    Setting "is_pathref" in the fsp_flags before calling fd_openat() is what
    triggers the special low-level behaviour inside the VFS.
    
    The use of pathref fsps allows updating all callers of path based VFS functions
    like
    
      dos_mode(smb_fname)
      -> SMB_VFS_GET_DOS_ATTRIBUTES(smb_fname)
         -> SMB_VFS_GETXATTR(smb_fname)
    
    to use the handle based VFS function like
    
      fdos_mode(smb_fname->fsp)
      -> SMB_VFS_FGET_DOS_ATTRIBUTES(fsp)
         -> SMB_VFS_FGETXATTR(fsp)
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit c1c2dd6c19f0d96648bfb16a2fa4433e7129f9fe
Author: Ralph Boehme <slow at samba.org>
Date:   Tue Nov 17 16:05:11 2020 +0100

    smbd: remove SMB_VFS_FSTAT() from open_file()
    
    This is now done in non_widelink_open().
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 2b45b9a09008b63c3aa0ea062ed3b2c0eafc960b
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Nov 16 13:54:49 2020 +0100

    smbd: always fstat in non_widelink_open()
    
    This way we can avoid stating twice: once here and possibly a second time in
    the caller open_file().
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit b6dfcae0cd0ef8481a2dd00c60ed77021d724cd4
Author: Ralph Boehme <slow at samba.org>
Date:   Tue Nov 24 12:30:58 2020 +0100

    smbd: convert non_widelink_open() and process_symlink_open() to return NTSTATUS
    
    non_widelink_open() now also returns NT_STATUS_STOPPED_ON_SYMLINK in case an
    attempt was made to either
    
    1. open a symlink from a POSIX client, or
    
    2. open a symlink from a Windows client but any of the symlink behaviour
       configuring options "follow symlink", "wide links" or "allow insecure wide
       links" prevents access to the symlink target
    
    Caller open_file() has already been updated to map NT_STATUS_STOPPED_ON_SYMLINK
    to NT_STATUS_NT_STATUS_OBJECT_PATH_NOT_FOUND.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 204c7b247b0a256113f873c3e785eada7a550b37
Author: Ralph Boehme <slow at samba.org>
Date:   Fri Oct 23 12:16:38 2020 +0200

    smbd: maps NT_STATUS_STOPPED_ON_SYMLINK to NT_STATUS_OBJECT_PATH_NOT_FOUND in open_file()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 241dd9d9a74970180b60a3521579c2f09ad06b3a
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Oct 26 12:31:10 2020 +0100

    smbd: pass private_flags to open_file()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 12d75a83ea85f9b971c03549f2069c6324dde5a5
Author: Ralph Boehme <slow at samba.org>
Date:   Tue Nov 24 12:30:28 2020 +0100

    smbd: deal with real dirfsps in non_widelink_open()
    
    If we get a real dirfsp, skip the parent-directory logic. Just pass the dirfsp
    to SMB_VFS_OPENAT() which by now supports real dirfsps.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 65c4f6158799374bd125647cd3216ed8fe6523ff
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Oct 19 10:19:28 2020 +0200

    smbd: simplify setting and resetting fsp->fsp_name in non_widelink_open()
    
    Instead of setting and resetting the name to the relative name every time we
    call into the VFS, just set it once and reset it at the end and when recursing
    via process_symlink_open().
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit ade0af788162d96cdc2e79aae8c79fca7a170315
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Oct 19 10:16:06 2020 +0200

    smbd: use orig_fsp_name as variable name in non_widelink_open()
    
    No change in behaviour.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit d680e9aab169cf83b7966df814f33d6a5532c2ab
Author: Ralph Boehme <slow at samba.org>
Date:   Tue Oct 13 16:47:51 2020 +0200

    smbd: remove unused cwdfsp from non_widelink_open()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 99f60a74e05d3336dbacadfd7ab3fa64f0a166da
Author: Ralph Boehme <slow at samba.org>
Date:   Tue Oct 13 16:38:18 2020 +0200

    smbd: pass dirfsp down to non_widelink_open() and process_symlink_open()
    
    Callers still all pass conn->cwd_fsp so no change in behaviour yet.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit abc00b959be9ba5e6ca7535405866d771e76bfb3
Author: Ralph Boehme <slow at samba.org>
Date:   Tue Oct 13 14:38:28 2020 +0200

    smbd: pass a dirfsp to fd_open() and rename it to fd_openat()
    
    For now no change in behaviour as all callers still pass conn->cwd_fsp. This
    just prepared fd_openat() to deal with real dirfsp's pass by callers later on
    when adding calls to fd_openat(dirfspm ...) in the directory enumeration loop.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit a272ca549fc7d2e935c3d3a103f3bd3f65b1960e
Author: Ralph Boehme <slow at samba.org>
Date:   Tue Sep 29 10:00:21 2020 +0200

    smbd: catch O_PATH opens of symlinks in in non_widelink_open()
    
    Calling openat() with O_PATH|O_NOFOLLOW will open a handle on the symlink
    itself. That would be a nice feature if it would be supported on more platforms,
    but being a Linux only thing, we have to preserve the behaviour of failing to
    open a handle on symlinks.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit abb7ab2c10eef05b54669c7bc947804d34470ee0
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Oct 12 13:21:07 2020 +0200

    smbd: already set fsp fd in non_widelink_open()
    
    A subsequent commit will add a consumer of the fd to non_widelink_open() (by
    calling SMB_VFS_FSTAT()), so we need to set the fd already here. And it makes
    more sense anyway. :)
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit eb6bbb4f0163ce7805b3691236abfb87757ed997
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Oct 26 14:39:02 2020 +0100

    smbd: check for pathref fd's in vfs_set_blocking()
    
    Don't try to set pathref fd's to non-blocking, they're not used with IO.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit f89808213015b36b22fbcba8cb26e14f33f8c9cb
Author: Ralph Boehme <slow at samba.org>
Date:   Fri Oct 16 12:28:39 2020 +0200

    vfs_shadow_copy2: deal with real dirfsps in shadow_copy2_openat()
    
    Prepare shadow_copy2_openat() for real dirfsps flying by.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit a14db893c19734f02d89f3b78f0ea75b79abbd72
Author: Ralph Boehme <slow at samba.org>
Date:   Tue Apr 14 17:44:37 2020 +0200

    s3: add full_path_from_dirfsp_atname()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 7d1e6e83d8a5565f84d3ab72df21d9beb83c081d
Author: Ralph Boehme <slow at samba.org>
Date:   Thu Oct 1 15:44:15 2020 +0200

    vfs_glusterfs: implement pathref opens with become_root() fallback
    
    Until glusterfs supports O_PATH, fallback to become_root().
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit fd8825742f7cc4acb705fdaec41ddb91967e37c5
Author: Ralph Boehme <slow at samba.org>
Date:   Thu Oct 1 15:44:15 2020 +0200

    vfs_ceph: implement pathref opens in cephwrap_openat()
    
    Ceph supports O_PATH since v0.93 from 2015:
    
    https://ceph.io/geen-categorie/v0-93-hammer-release-candidate-released/
    
    This seems to be old enough so we can hopefully use this without a runtime
    version check.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit cf3c48cb08811e45b6d88a4c27b873485321beb0
Author: Ralph Boehme <slow at samba.org>
Date:   Fri Oct 9 14:24:43 2020 +0200

    vfs_default: implement pathref opens in vfswrap_openat()
    
    If the system supports O_PATH we use that, otherwise we fallback to root opens.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 879d8a3be9f660384f49657b8214168c4b62aee5
Author: Ralph Boehme <slow at samba.org>
Date:   Thu Oct 1 15:22:18 2020 +0200

    smbd/posix_acls: support pathref fd's in posix_sys_acl_blob_get_fd()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit c9889c194aa61c20ff91baa14ef4f2d37d292e86
Author: Ralph Boehme <slow at samba.org>
Date:   Thu Oct 1 15:21:45 2020 +0200

    vfs_posixacl: support pathref fd's in posixacl_sys_acl_set_fd()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit b2e6d7b00bc01523631ebbcebaa7f8dbbd626bd0
Author: Ralph Boehme <slow at samba.org>
Date:   Thu Oct 1 15:20:56 2020 +0200

    vfs_posixacl: support pathref fd's in posixacl_sys_acl_get_fd()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 011252c6111871e7376450caf7cf7d6f2ff80cde
Author: Ralph Boehme <slow at samba.org>
Date:   Sat Aug 1 16:19:20 2020 +0200

    vfs_fruit: skip Netatalk locking checks for path-ref fd's
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 9b3c80f8c1cfef77b9e376682065796690cd8e3d
Author: Ralph Boehme <slow at samba.org>
Date:   Tue Sep 29 11:11:53 2020 +0200

    vfs_default: support pathref fd's in vfswrap_fsetxattr()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit a46f987ce57ee2e50c80431a53fc3573bc7c22aa
Author: Ralph Boehme <slow at samba.org>
Date:   Tue Sep 29 11:10:51 2020 +0200

    vfs_default: support pathref fd's in vfswrap_fremovexattr()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 0f353bca64a7e64c951ca2c5ba04bdda4333a0d6
Author: Ralph Boehme <slow at samba.org>
Date:   Tue Sep 29 10:56:19 2020 +0200

    vfs_default: support pathref fd's in vfswrap_flistxattr()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 3105e53f62481624650dd4f5d37920b1a778591a
Author: Ralph Boehme <slow at samba.org>
Date:   Tue Sep 29 10:55:52 2020 +0200

    vfs_default: support pathref fd's in vfswrap_fgetxattr()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 6d16e580905296a8ae9f2dcd499ed63a587485df
Author: Ralph Boehme <slow at samba.org>
Date:   Wed Nov 25 07:05:20 2020 +0100

    vfs_default: initialize conn->have_proc_fds
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 11e2a8562f8e15c2c24e54cf108bb7beb98852fd
Author: Ralph Boehme <slow at samba.org>
Date:   Wed Nov 25 07:04:31 2020 +0100

    vfs_default: fix indentation
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 2af46c7fda60780e85a37ff0872a3a8c5b1631ff
Author: Ralph Boehme <slow at samba.org>
Date:   Tue Nov 24 12:20:23 2020 +0100

    vfs: add fsp flag "have_proc_fds"
    
    This flag is used by the VFS layer to tell the FSA layer that it is allowed to
    reopen an fsp by using an exisiting pathref fd with /proc/PID/fd/FD to open a
    full fd.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 1f94c3ee7be39433a5518cefa95ecc1392341675
Author: Ralph Boehme <slow at samba.org>
Date:   Wed Nov 25 05:32:19 2020 +0100

    vfs: add struct connection_struct flag "have_proc_fds"
    
    Allows the VFS layer to tell the higher layers if fds opened by the openat() VFS
    implementation are visible objects inside a /proc/PID/fd/FD filesystem.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 1d35fc7f5456c91325745d2914d539cd70763ae4
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Jun 15 11:33:39 2020 +0200

    vfs_error_inject: ignore path_ref_fd's
    
    This avoids failing opens triggered by filename_convert() ->
    openat_pathref_fsp().
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit c39940d81b000a721d70ab9c19787f5bf5716b55
Author: Ralph Boehme <slow at samba.org>
Date:   Wed Sep 30 14:45:34 2020 +0200

    s3/lib: add proc fds infrastructure
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit b56f554ff00437993ae7fa37dcaebf9a080bf3e9
Author: Ralph Boehme <slow at samba.org>
Date:   Sun Sep 27 19:39:37 2020 +0200

    vfs: make struct fd_handle private
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit dd8fe0cfc2627dcdcec140a85eb96b9da5a6dba4
Author: Ralph Boehme <slow at samba.org>
Date:   Fri Oct 2 17:40:51 2020 +0200

    smbd: remove redundant initialisation of the fsp fd
    
    This is already set to -1 by fd_handle_create().
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 140df3218a547f70354064f7def68d9d2d12b63d
Author: Ralph Boehme <slow at samba.org>
Date:   Sun Sep 27 21:16:03 2020 +0200

    smbd: use fd_handle_create()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit fdb91631185978664eaac0b79e3c6ab9ddff9079
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Sep 28 10:37:36 2020 +0200

    smbd: use fh_[get|set]_refcount()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit da786ccd1d2bf834b75f9a9c067f6ae4911dd5a2
Author: Ralph Boehme <slow at samba.org>
Date:   Fri Oct 23 17:47:46 2020 +0200

    smbd: use fh_[get|set]_private_options()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 059dee953d6cc443eb2cd81d9d92cdeedc9390ea
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Sep 28 10:35:32 2020 +0200

    smbd: use fh_[get|set]_gen_id()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 0d9afd7ab887d57c110a22c6a15241bf03ac0a59
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Sep 28 10:32:29 2020 +0200

    smbd: use fh_[get|set]_pos() and fh_[get|set]_position_information()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 61628adef65eefe21efc358f886af28f68e8c0ce
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Oct 5 07:51:50 2020 +0200

    smbd: use fsp_get_pathref_fd() for logical fd comparisons
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 450d7f134c7c1e6d88f00a58e83d962be0b0bb09
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Oct 5 07:50:16 2020 +0200

    smbd: use fsp_get_pathref_fd() for fstat() calls
    
    If we can access the path to a file, by default we have FILE_READ_ATTRIBUTES
    from the containing directory. See the section: "Algorithm to Check Access to an
    Existing File" in MS-FSA.pdf.
    
    So it's also safe to use a root opened pathref fd, as the root open is done on
    the final component after a chdir() to the parent directory was done while still
    impersonating the use. Qed.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 5648662b2f2b91133d3ec8ece69a32955348fa23
Author: Ralph Boehme <slow at samba.org>
Date:   Sun Oct 4 14:48:48 2020 +0200

    smbd: use fsp_get_pathref_fd() for "internal" xattr functions
    
    We're using xattr data storage for internal reasons in these places, so in all
    places it's safe to use a possibly root opened fd.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit bc908ea3f2eb2284b625bc257264235cad0a7951
Author: Ralph Boehme <slow at samba.org>
Date:   Sat Oct 17 17:01:47 2020 +0200

    smbd: use fsp_get_pathref_fd() for *at related directory handles
    
    Obviously correct to use fsp_get_pathref_fd() here.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 0208ca6946db7f800977d20cdda0ae7df03ae635
Author: Ralph Boehme <slow at samba.org>
Date:   Sat Oct 3 21:24:29 2020 +0200

    smbd: use fsp_get_pathref_fd() when close()ing fds
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit f5632b43337c04e4c51c952326324fb475646ec3
Author: Ralph Boehme <slow at samba.org>
Date:   Sat Oct 3 17:41:17 2020 +0200

    smbd: use fsp_get_pathref_fd() as part of DEBUG and syslog messages
    
    Nothing really dangerous is done with the fds here, so we can safely use
    fsp_get_pathref_fd() in these cases.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 9db3ff257322a8dd0602cdbf6d3ac4f4f8cfa0e0
Author: Ralph Boehme <slow at samba.org>
Date:   Sat Sep 26 21:52:52 2020 +0200

    smbd: use fsp_get_io_fd() when accessing a file or it's associated metadata
    
    In all places where we access or modify a file or it's associated metadata, we
    use fsp_get_io_fd() to fetch the low-level fd from the fsp. This ensures we
    don't accidentally use a pathref fsp where the fd would be opened as root on
    systems lacking O_PATH.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 50ce980902c9bd76bb4e800fb7d142013605e737
Author: Ralph Boehme <slow at samba.org>
Date:   Sat Sep 26 21:46:51 2020 +0200

    smbd: use fsp_set_fd()
    
    No change in behaviour.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 28f43fdadc89bdc2e3041fe077df2389acd0ceaa
Author: Ralph Boehme <slow at samba.org>
Date:   Sun Sep 27 13:14:30 2020 +0200

    smbd: add fd_handle.[c|h]
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit c6c65d1fc180e4070f6d3ec031b8dac66f3ab276
Author: Ralph Boehme <slow at samba.org>
Date:   Sun Nov 22 13:54:51 2020 +0100

    vfs: add "is_fsa" flag to struct files_struct
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit bf7ab87877a4572ad2da442c59d1ec9be26ab96f
Author: Ralph Boehme <slow at samba.org>
Date:   Tue Jul 14 10:10:19 2020 +0200

    vfs: add "is_pathref" to struct files_struct
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 703c18980348add3414f7bb27f3b9c770f5bed6e
Author: Ralph Boehme <slow at samba.org>
Date:   Tue Dec 15 07:20:55 2020 +0100

    CI: skip kernel-oplocks tests on older kernels
    
    The kernel of the gitlab shared runners container host has a bug in the
    interaction between kernel oplocks and O_PATH opens which was fixed by
    387e3746d01c34457d6a73688acd90428725070b in 5.3.1:
    
    <https://kernel.googlesource.com/pub/scm/linux/kernel/git/jlayton/linux/+/refs/tags/locks-v5.3-1%5E%21/>
    
    Don't actually start the OPLOCK5 test is kernel oplocks are not available,
    instead of relying on the #ifdef HAVE_KERNEL_OPLOCKS_LINUX magic in torture.c.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 436903afe2aaf6e3afe794c9ebe22081a55b9bb3
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Jun 22 13:32:45 2020 +0200

    CI: add samba-no-opath
    
    Add a job that builds with O_PATH undefined.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

-----------------------------------------------------------------------

Summary of changes:
 .gitlab-ci.yml                                     |   3 +
 docs-xml/manpages/vfs_full_audit.8.xml             |   2 +-
 examples/VFS/skel_opaque.c                         |  17 +-
 examples/VFS/skel_transparent.c                    |  23 +-
 lib/replace/system/filesys.h                       |   4 +
 script/autobuild.py                                |  21 +
 selftest/skip.opath-required                       |   9 +
 selftest/wscript                                   |   3 +
 source3/include/proto.h                            |   7 +
 source3/include/smb_macros.h                       |  12 +-
 source3/include/vfs.h                              | 227 +++++-
 source3/include/vfs_macros.h                       |  20 +-
 source3/lib/adouble.c                              |  40 +-
 source3/lib/system.c                               |  56 ++
 source3/locking/posix.c                            |  18 +-
 source3/locking/share_mode_lock.c                  |  15 +-
 source3/modules/vfs_acl_common.c                   |   4 +-
 source3/modules/vfs_acl_tdb.c                      |   7 +-
 source3/modules/vfs_acl_xattr.c                    |   4 +-
 source3/modules/vfs_afsacl.c                       |   2 +-
 source3/modules/vfs_aio_fork.c                     |  18 +-
 source3/modules/vfs_aio_pthread.c                  |  10 +-
 source3/modules/vfs_aixacl.c                       |   8 +-
 source3/modules/vfs_aixacl2.c                      |   2 +-
 source3/modules/vfs_audit.c                        |   2 +-
 source3/modules/vfs_btrfs.c                        |  91 ++-
 source3/modules/vfs_cacheprime.c                   |   2 +-
 source3/modules/vfs_cap.c                          |   7 +-
 source3/modules/vfs_catia.c                        |  86 +--
 source3/modules/vfs_ceph.c                         |  61 +-
 source3/modules/vfs_commit.c                       |  12 +-
 source3/modules/vfs_default.c                      | 309 +++++---
 source3/modules/vfs_dirsort.c                      |  17 +-
 source3/modules/vfs_error_inject.c                 |   3 +-
 source3/modules/vfs_extd_audit.c                   |   4 +-
 source3/modules/vfs_fruit.c                        |  34 +-
 source3/modules/vfs_full_audit.c                   |  45 +-
 source3/modules/vfs_glusterfs.c                    |  24 +-
 source3/modules/vfs_gpfs.c                         | 123 +--
 source3/modules/vfs_io_uring.c                     |   6 +-
 source3/modules/vfs_media_harmony.c                |   9 +-
 source3/modules/vfs_nfs4acl_xattr.c                |   6 +-
 source3/modules/vfs_not_implemented.c              |  17 +-
 source3/modules/vfs_offline.c                      |   9 -
 source3/modules/vfs_posix_eadb.c                   |   8 +-
 source3/modules/vfs_posixacl.c                     |  45 +-
 source3/modules/vfs_prealloc.c                     |   2 +-
 source3/modules/vfs_readahead.c                    |  16 +-
 source3/modules/vfs_shadow_copy.c                  |  11 +-
 source3/modules/vfs_shadow_copy2.c                 |  37 +-
 source3/modules/vfs_solarisacl.c                   |   6 +-
 source3/modules/vfs_streams_depot.c                |   4 +-
 source3/modules/vfs_streams_xattr.c                |  12 +-
 source3/modules/vfs_syncops.c                      |   2 +-
 source3/modules/vfs_time_audit.c                   |  48 +-
 source3/modules/vfs_tru64acl.c                     |   4 +-
 source3/modules/vfs_tsmsm.c                        |  19 +-
 source3/modules/vfs_unityed_media.c                |   5 +-
 source3/modules/vfs_virusfilter.c                  |   2 +-
 source3/modules/vfs_vxfs.c                         |  14 +-
 source3/modules/vfs_widelinks.c                    |  10 +-
 source3/modules/vfs_xattr_tdb.c                    |  23 +-
 source3/printing/nt_printing.c                     |  25 +-
 source3/printing/printspoolss.c                    |  13 +-
 source3/selftest/tests.py                          |  25 +-
 source3/smbd/aio.c                                 |  12 +-
 source3/smbd/close.c                               |   6 +-
 source3/smbd/conn.c                                |   4 +-
 source3/smbd/dir.c                                 | 156 +++-
 source3/smbd/dosmode.c                             | 110 ++-
 source3/smbd/durable.c                             |  16 +-
 source3/smbd/fake_file.c                           |   4 +-
 source3/smbd/fd_handle.c                           | 124 +++
 source3/smbd/fd_handle.h                           |  48 ++
 .../util_macstreams.h => smbd/fd_handle_private.h} |  28 +-
 source3/smbd/fileio.c                              |  17 +-
 source3/smbd/filename.c                            | 117 ++-
 source3/smbd/files.c                               | 441 ++++++++++-
 source3/smbd/nttrans.c                             |   6 +-
 source3/smbd/open.c                                | 849 ++++++++++++++-------
 source3/smbd/oplock.c                              |   6 +-
 source3/smbd/oplock_linux.c                        |  10 +-
 source3/smbd/pipes.c                               |   2 +-
 source3/smbd/posix_acls.c                          |  53 +-
 source3/smbd/proto.h                               |  45 +-
 source3/smbd/pysmbd.c                              |  18 +-
 source3/smbd/reply.c                               | 187 +++--
 source3/smbd/smb1_utils.c                          |  15 +-
 source3/smbd/smb2_close.c                          |  12 +-
 source3/smbd/smb2_create.c                         |   3 +-
 source3/smbd/smb2_flush.c                          |   2 +-
 source3/smbd/smb2_getinfo.c                        |   2 +-
 source3/smbd/smb2_ioctl_filesys.c                  |   3 +-
 source3/smbd/smb2_query_directory.c                |   2 +-
 source3/smbd/smb2_setinfo.c                        |  38 +-
 source3/smbd/smbd.h                                |   1 +
 source3/smbd/trans2.c                              | 345 +++++----
 source3/smbd/vfs.c                                 |  60 +-
 source3/torture/cmd_vfs.c                          |  71 +-
 source3/torture/proto.h                            |   5 +
 source3/torture/test_posix.c                       | 722 ++++++++++++++++++
 source3/torture/torture.c                          |  55 +-
 source3/utils/net_vfs.c                            |  10 +
 source3/wscript_build                              |   6 +
 104 files changed, 3800 insertions(+), 1541 deletions(-)
 create mode 100644 selftest/skip.opath-required
 create mode 100644 source3/smbd/fd_handle.c
 create mode 100644 source3/smbd/fd_handle.h
 copy source3/{lib/util_macstreams.h => smbd/fd_handle_private.h} (57%)
 create mode 100644 source3/torture/test_posix.c


Changeset truncated at 500 lines:

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 7a7582cb6db..eafd454d445 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -226,6 +226,9 @@ samba-schemaupgrade:
 samba-ad-dc-1-mitkrb5:
   extends: .private_template
 
+samba-no-opath:
+  extends: .private_template
+
 # 'pages' is a special job which can publish artifacts in `public` dir to gitlab pages
 pages:
   image: ${SAMBA_CI_CONTAINER_REGISTRY}/samba-ci-${SAMBA_CI_CONTAINER_IMAGE}:${SAMBA_CI_CONTAINER_TAG}
diff --git a/docs-xml/manpages/vfs_full_audit.8.xml b/docs-xml/manpages/vfs_full_audit.8.xml
index 674b032017d..d4fbdb4f02e 100644
--- a/docs-xml/manpages/vfs_full_audit.8.xml
+++ b/docs-xml/manpages/vfs_full_audit.8.xml
@@ -60,6 +60,7 @@
         <member>fchmod</member>
         <member>fchown</member>
         <member>fdopendir</member>
+        <member>fget_compression</member>
         <member>fget_dos_attributes</member>
         <member>fget_nt_acl_at</member>
         <member>fgetxattr</member>
@@ -78,7 +79,6 @@
         <member>fsync_send</member>
         <member>ftruncate</member>
         <member>get_alloc_size</member>
-        <member>get_compression</member>
         <member>get_dfs_referrals</member>
         <member>get_dos_attributes</member>
         <member>get_dos_attributes_recv</member>
diff --git a/examples/VFS/skel_opaque.c b/examples/VFS/skel_opaque.c
index 2a3a7301bdb..881a7fdaf1c 100644
--- a/examples/VFS/skel_opaque.c
+++ b/examples/VFS/skel_opaque.c
@@ -156,7 +156,9 @@ static DIR *skel_fdopendir(vfs_handle_struct *handle, files_struct *fsp,
 }
 
 static struct dirent *skel_readdir(vfs_handle_struct *handle,
-				   DIR *dirp, SMB_STRUCT_STAT *sbuf)
+				   struct files_struct *dirfsp,
+				   DIR *dirp,
+				   SMB_STRUCT_STAT *sbuf)
 {
 	return NULL;
 }
@@ -618,10 +620,9 @@ static NTSTATUS skel_offload_write_recv(struct vfs_handle_struct *handle,
 	return NT_STATUS_OK;
 }
 
-static NTSTATUS skel_get_compression(struct vfs_handle_struct *handle,
+static NTSTATUS skel_fget_compression(struct vfs_handle_struct *handle,
 				     TALLOC_CTX *mem_ctx,
 				     struct files_struct *fsp,
-				     struct smb_filename *smb_fname,
 				     uint16_t *_compression_fmt)
 {
 	return NT_STATUS_INVALID_DEVICE_REQUEST;
@@ -713,13 +714,6 @@ static NTSTATUS skel_readdir_attr(struct vfs_handle_struct *handle,
 	return NT_STATUS_NOT_IMPLEMENTED;
 }
 
-static NTSTATUS skel_get_dos_attributes(struct vfs_handle_struct *handle,
-				struct smb_filename *smb_fname,
-				uint32_t *dosmode)
-{
-	return NT_STATUS_NOT_IMPLEMENTED;
-}
-
 struct skel_get_dos_attributes_state {
 	struct vfs_aio_state aio_state;
 	uint32_t dosmode;
@@ -1111,7 +1105,7 @@ static struct vfs_fn_pointers skel_opaque_fns = {
 	.offload_read_recv_fn = skel_offload_read_recv,
 	.offload_write_send_fn = skel_offload_write_send,
 	.offload_write_recv_fn = skel_offload_write_recv,
-	.get_compression_fn = skel_get_compression,
+	.fget_compression_fn = skel_fget_compression,
 	.set_compression_fn = skel_set_compression,
 
 	.streaminfo_fn = skel_streaminfo,
@@ -1126,7 +1120,6 @@ static struct vfs_fn_pointers skel_opaque_fns = {
 	.audit_file_fn = skel_audit_file,
 
 	/* DOS attributes. */
-	.get_dos_attributes_fn = skel_get_dos_attributes,
 	.get_dos_attributes_send_fn = skel_get_dos_attributes_send,
 	.get_dos_attributes_recv_fn = skel_get_dos_attributes_recv,
 	.fget_dos_attributes_fn = skel_fget_dos_attributes,
diff --git a/examples/VFS/skel_transparent.c b/examples/VFS/skel_transparent.c
index a86b3e7cd19..2680b4f3285 100644
--- a/examples/VFS/skel_transparent.c
+++ b/examples/VFS/skel_transparent.c
@@ -164,9 +164,11 @@ static DIR *skel_fdopendir(vfs_handle_struct *handle, files_struct *fsp,
 }
 
 static struct dirent *skel_readdir(vfs_handle_struct *handle,
-				   DIR *dirp, SMB_STRUCT_STAT *sbuf)
+				   struct files_struct *dirfsp,
+				   DIR *dirp,
+				   SMB_STRUCT_STAT *sbuf)
 {
-	return SMB_VFS_NEXT_READDIR(handle, dirp, sbuf);
+	return SMB_VFS_NEXT_READDIR(handle, dirfsp, dirp, sbuf);
 }
 
 static void skel_seekdir(vfs_handle_struct *handle, DIR *dirp, long offset)
@@ -827,13 +829,12 @@ static NTSTATUS skel_offload_write_recv(struct vfs_handle_struct *handle,
 	return NT_STATUS_OK;
 }
 
-static NTSTATUS skel_get_compression(struct vfs_handle_struct *handle,
+static NTSTATUS skel_fget_compression(struct vfs_handle_struct *handle,
 				     TALLOC_CTX *mem_ctx,
 				     struct files_struct *fsp,
-				     struct smb_filename *smb_fname,
 				     uint16_t *_compression_fmt)
 {
-	return SMB_VFS_NEXT_GET_COMPRESSION(handle, mem_ctx, fsp, smb_fname,
+	return SMB_VFS_NEXT_FGET_COMPRESSION(handle, mem_ctx, fsp,
 					    _compression_fmt);
 }
 
@@ -933,15 +934,6 @@ static NTSTATUS skel_readdir_attr(struct vfs_handle_struct *handle,
 	return SMB_VFS_NEXT_READDIR_ATTR(handle, fname, mem_ctx, pattr_data);
 }
 
-static NTSTATUS skel_get_dos_attributes(struct vfs_handle_struct *handle,
-				struct smb_filename *smb_fname,
-				uint32_t *dosmode)
-{
-	return SMB_VFS_NEXT_GET_DOS_ATTRIBUTES(handle,
-				smb_fname,
-				dosmode);
-}
-
 struct skel_get_dos_attributes_state {
 	struct vfs_aio_state aio_state;
 	uint32_t dosmode;
@@ -1418,7 +1410,7 @@ static struct vfs_fn_pointers skel_transparent_fns = {
 	.offload_read_recv_fn = skel_offload_read_recv,
 	.offload_write_send_fn = skel_offload_write_send,
 	.offload_write_recv_fn = skel_offload_write_recv,
-	.get_compression_fn = skel_get_compression,
+	.fget_compression_fn = skel_fget_compression,
 	.set_compression_fn = skel_set_compression,
 
 	.streaminfo_fn = skel_streaminfo,
@@ -1433,7 +1425,6 @@ static struct vfs_fn_pointers skel_transparent_fns = {
 	.audit_file_fn = skel_audit_file,
 
 	/* DOS attributes. */
-	.get_dos_attributes_fn = skel_get_dos_attributes,
 	.get_dos_attributes_send_fn = skel_get_dos_attributes_send,
 	.get_dos_attributes_recv_fn = skel_get_dos_attributes_recv,
 	.fget_dos_attributes_fn = skel_fget_dos_attributes,
diff --git a/lib/replace/system/filesys.h b/lib/replace/system/filesys.h
index 976b2aeec5e..034e5d5886c 100644
--- a/lib/replace/system/filesys.h
+++ b/lib/replace/system/filesys.h
@@ -199,6 +199,10 @@
 #define mkdir(d,m) _mkdir(d)
 #endif
 
+#ifdef DISABLE_OPATH
+#undef O_PATH
+#endif
+
 /*
    this allows us to use a uniform error handling for our xattr
    wrappers
diff --git a/script/autobuild.py b/script/autobuild.py
index a76309df8a2..00ba8d727b0 100755
--- a/script/autobuild.py
+++ b/script/autobuild.py
@@ -375,6 +375,27 @@ tasks = {
         ("check-clean-tree", "script/clean-source-tree.sh"),
         ],
 
+    "samba-no-opath": [
+        ("random-sleep", random_sleep(300, 900)),
+        ("configure", "ADDITIONAL_CFLAGS='-DDISABLE_OPATH=1' ./configure.developer --without-ad-dc --with-selftest-prefix=./bin/ab" + samba_configure_params),
+        ("make", "make -j"),
+        ("test", make_test(
+            cmd="make test DISABLE_OPATH=1",
+            include_envs=[
+            "nt4_dc",
+            "nt4_dc_smb1",
+            "nt4_dc_smb1_done",
+            "nt4_dc_schannel",
+            "nt4_member",
+            "simpleserver",
+            "fileserver",
+            "fileserver_smb1",
+            "fileserver_smb1_done",
+            ])),
+        ("lcov", LCOV_CMD),
+        ("check-clean-tree", "script/clean-source-tree.sh"),
+        ],
+
     "samba-ad-dc-1": [
         ("random-sleep", random_sleep(1, 1)),
         ("configure", "./configure.developer --with-selftest-prefix=./bin/ab" + samba_configure_params),
diff --git a/selftest/skip.opath-required b/selftest/skip.opath-required
new file mode 100644
index 00000000000..0faf0c4bd6c
--- /dev/null
+++ b/selftest/skip.opath-required
@@ -0,0 +1,9 @@
+# Opening O_RDONLY screws kernel oplocks which is not a problem
+# as only Linux has kernel oplocks and as Linux has O_PATH, we
+# don't need O_RDONLY in the first place.
+^samba3.smb2.kernel-oplocks.*
+^samba3.smbtorture_s3.plain.OPLOCK5.*
+#
+# These fail because become_root() doesn't work in make test
+^samba3.blackbox.dropbox.*
+^samba3.raw.samba3hide.*
diff --git a/selftest/wscript b/selftest/wscript
index b057702b756..60297045078 100644
--- a/selftest/wscript
+++ b/selftest/wscript
@@ -271,6 +271,9 @@ def cmd_testonly(opt):
         # GSS_KRB5_CRED_NO_CI_FLAGS_X
         env.OPTIONS += " --exclude=${srcdir}/selftest/skip.no-GSS_KRB5_CRED_NO_CI_FLAGS_X"
 
+    if os.environ.get('DISABLE_OPATH'):
+        env.OPTIONS += " --exclude=${srcdir}/selftest/skip.opath-required"
+
     if env.ADDRESS_SANITIZER:
         # We try to find the correct libasan automatically
         libasan = Utils.cmd_output(
diff --git a/source3/include/proto.h b/source3/include/proto.h
index 9f74287f967..6e14ac42777 100644
--- a/source3/include/proto.h
+++ b/source3/include/proto.h
@@ -237,6 +237,9 @@ char *sys_realpath(const char *path);
 int sys_get_number_of_cores(void);
 #endif
 
+bool sys_have_proc_fds(void);
+const char *sys_proc_fd_path(int fd, char *buf, int bufsize);
+
 struct stat;
 void init_stat_ex_from_stat (struct stat_ex *dst,
 			    const struct stat *src,
@@ -785,6 +788,10 @@ struct smb_filename *synthetic_smb_fname(TALLOC_CTX *mem_ctx,
 					 const SMB_STRUCT_STAT *psbuf,
 					 NTTIME twrp,
 					 uint32_t flags);
+struct smb_filename *full_path_from_dirfsp_atname(
+	TALLOC_CTX *mem_ctx,
+	const struct files_struct *dirfsp,
+	const struct smb_filename *atname);
 struct smb_filename *synthetic_smb_fname_split(TALLOC_CTX *ctx,
 						const char *fname,
 						bool posix_path);
diff --git a/source3/include/smb_macros.h b/source3/include/smb_macros.h
index 1513696f766..d9583945c55 100644
--- a/source3/include/smb_macros.h
+++ b/source3/include/smb_macros.h
@@ -45,7 +45,8 @@
 #define IS_PRINT(conn)       ((conn) && (conn)->printer)
 
 #define CHECK_READ(fsp,req) \
-	(((fsp)->fh->fd != -1) && \
+	((!(fsp)->fsp_flags.is_pathref) &&  \
+	 (fsp_get_io_fd(fsp) != -1) && \
 	 (((fsp)->fsp_flags.can_read) || \
 	  ((req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) && \
 	   (fsp->access_mask & FILE_EXECUTE))))
@@ -63,7 +64,8 @@
  * test).
  */
 #define CHECK_READ_SMB2(fsp) \
-	(((fsp)->fh->fd != -1) && \
+	((!(fsp)->fsp_flags.is_pathref) &&  \
+	 (fsp_get_io_fd(fsp) != -1) && \
 	 (((fsp)->fsp_flags.can_read) || \
 	  (fsp->access_mask & FILE_EXECUTE)))
 
@@ -74,12 +76,14 @@
  * the "if execute is granted then also grant read" arrangement.
  */
 #define CHECK_READ_IOCTL(fsp) \
-	(((fsp)->fh->fd != -1) && \
+	((!(fsp)->fsp_flags.is_pathref) &&  \
+	 (fsp_get_io_fd(fsp) != -1) && \
 	 (((fsp)->fsp_flags.can_read)))
 
 #define CHECK_WRITE(fsp) \
 	((fsp)->fsp_flags.can_write && \
-	 ((fsp)->fh->fd != -1))
+	(!(fsp)->fsp_flags.is_pathref) && \
+	 (fsp_get_io_fd(fsp) != -1))
 
 #define ERROR_WAS_LOCK_DENIED(status) (NT_STATUS_EQUAL((status), NT_STATUS_LOCK_NOT_GRANTED) || \
 				NT_STATUS_EQUAL((status), NT_STATUS_FILE_LOCK_CONFLICT) )
diff --git a/source3/include/vfs.h b/source3/include/vfs.h
index 91151df6e06..1a5d71e8401 100644
--- a/source3/include/vfs.h
+++ b/source3/include/vfs.h
@@ -333,6 +333,13 @@
  * Version 44 - Make dirfsp arg to SMB_VFS_READLINKAT() const
  * Version 44 - Add a flag 'encryption_required' to files_struct that that
  *              prevents that encrypted connections can be downgraded.
+ * Version 44 - Add a flag 'is_pathref' to struct files_struct.
+ * Version 44 - Add 'is_fsa' flag to struct files_struct.
+ * Version 44 - Add 'have_proc_fds' flag to struct connection_struct.
+ * Version 44 - Add 'have_proc_fds' flag to struct files_struct.
+ * Version 44 - Add dirfsp arg to SMB_VFS_READDIR()
+ * Version 44 - Remove SMB_VFS_GET_DOS_ATTRIBUTES()
+ * Version 44 - Replace SMB_VFS_GET_COMPRESSION() with SMB_VFS_FGET_COMPRESSION()
  */
 
 #define SMB_VFS_INTERFACE_VERSION 44
@@ -361,21 +368,7 @@ typedef union unid_t {
 	gid_t gid;
 } unid_t;
 
-struct fd_handle {
-	size_t ref_count;
-	int fd;
-	uint64_t position_information;
-	off_t pos;
-	uint32_t private_options;	/* NT Create options, but we only look at
-				 * NTCREATEX_OPTIONS_PRIVATE_DENY_DOS and
-				 * NTCREATEX_OPTIONS_PRIVATE_DENY_FCB and
-				 * NTCREATEX_OPTIONS_PRIVATE_DELETE_ON_CLOSE
-				 * for print files *only*, where
-				 * DELETE_ON_CLOSE is not stored in the share
-				 * mode database.
-				 */
-	uint64_t gen_id;
-};
+struct fd_handle;
 
 struct fsp_lease {
 	size_t ref_count;
@@ -398,6 +391,9 @@ typedef struct files_struct {
 	struct timeval open_time;
 	uint32_t access_mask;		/* NTCreateX access bits (FILE_READ_DATA etc.) */
 	struct {
+		bool is_pathref : 1; /* See below */
+		bool is_fsa : 1;     /* See below */
+		bool have_proc_fds : 1;
 		bool kernel_share_modes_taken : 1;
 		bool update_write_time_triggered : 1;
 		bool update_write_time_on_close : 1;
@@ -490,6 +486,159 @@ typedef struct files_struct {
 	uint64_t lock_failure_offset;
 } files_struct;
 
+/*
+ * The fsp flags "is_pathref" and "is_fsa"
+ * =======================================
+ *
+ * Summary
+ * -------
+ *
+ * The flag "is_pathref" is a property of the low-level VFS-layer file
+ * handle. If "is_pathref" is true, only a subset of VFS calls are allowed
+ * on the handle and on systems that support it, the low-level fd is open
+ * with O_PATH. If "is_pathref" is false, the low-level fd is a "normal"
+ * file descriptor that can be used with all VFS calls.
+ *
+ * The flag "is_fsa" is a property of the FSA layer in Samba. The term FSA
+ * layer refers to the parts of smbs that implement Windows NTFS semantics
+ * on-top of a POSIX filesystem. If "is_fsa" is true, the fsp was
+ * processed by the SMB_VFS_CREATE_FILE() VFS call, otherwise the fsp was
+ * created by openat_pathref_fsp() which only connected the low-level
+ * handle by calling into VFS SMB_VFS_OPENAT(), but the whole FSA layer
+ * logic is skipped.
+ *
+ * Note that only three possible combinations of "is_pathref" and "is_fsa"
+ * are possible:
+ *
+ * | is_fsa \ is_pathref | + | - |
+ * |---------------------+---+---|
+ * | +                   | + | + |
+ * | -                   | + | - |
+ *
+ * So a fsp can't be a full low-level fd (is_pathref=false) and not be
+ * processed by the FSA layer.
+ *
+ * Details
+ * -------
+ *
+ * On Linux the O_PATH flag to open() can be used to open a filehandle on
+ * a file or directory with interesting properties:
+ *
+ * - the file-handle indicates a location in the filesystem tree,
+ * - no permission checks are done by the kernel and
+ * - only operations that act purely at the file descriptor level are
+ *   allowed.
+ *
+ * The file itself is not opened, and other file operations (e.g.,
+ * read(2), write(2), fchmod(2), fchown(2), fgetxattr(2), ioctl(2),
+ * mmap(2)) fail with the error EBADF.
+ *
+ * The following subset of operations that is relevant to Samba is allowed:
+ *
+ * - close(2),
+ * - fchdir(2), if the file descriptor refers to a directory,
+ * - fstat(2),
+ * - fstatfs(2) and
+ * - passing the file descriptor as the dirfd argument of openat() and the
+ *   other "*at()" system calls. This includes linkat(2) with
+ *   AT_EMPTY_PATH (or via procfs using AT_SYMLINK_FOLLOW) even if the
+ *   file is not a directory.
+ *
+ * Opening a file or directory with the O_PATH flag requires no
+ * permissions on the object itself (but does require execute permission
+ * on the directories in the path prefix). By contrast, obtaining a
+ * reference to a filesystem object by opening it with the O_RDONLY flag
+ * requires that the caller have read permission on the object, even when
+ * the subsequent operation (e.g., fchdir(2), fstat(2)) does not require
+ * read permis? sion on the object. [1]
+ *
+ * If for example Samba receives an SMB request to open a file requesting
+ * SEC_FILE_READ_ATTRIBUTE access rights because the client wants to read
+ * the file's metadata from the handle, Samba will have to call POSIX
+ * open() with at least O_RDONLY access rights.
+ *
+ * Usecase for O_PATH in Samba
+ * ---------------------------
+ *
+ * By leveraging this Linux specific flags we can avoid permission
+ * mismatches as described above. Additionally O_PATH allows basing all
+ * filesystem accesses done by the fileserver on handle based syscalls by
+ * opening all client pathnames with O_PATH and consistently using for
+ * example fstat() instead of stat() throughout the codebase.
+ *
+ * Subsequently we will refer to Samba file-handles (fsp's) opened with
+ * O_PATH "path referencing fsp's" or "pathref" fsp's for short.
+ *
+ * Currently Samba bases the decision whether to call POSIX open() on a
+ * client pathname or whether to leave the low-level handle at -1, what we
+ * call a stat-open, in the function open_file() and it is based on the
+ * client requested SMB acccess mask.
+ *
+ * The set of rights that trigger an open() include READ_CONTROL_ACCESS,
+ * resulting in a call to open() with at least O_RDONLY. If the filesystem
+ * supports NT style ACLs natively (like GPFS or ZFS), the filesystem may
+ * grant the user requested right READ_CONTROL_ACCESS, but it may not
+ * grant READ_DATA (O_RDONLY), resulting in a permission denied error.
+ *
+ * Historically the set of access rights that triggered opening a file was:
+ *
+ *   FILE_READ_DATA
+ *   FILE_WRITE_DATA
+ *   FILE_APPEND_DATA
+ *   FILE_EXECUTE
+ *   WRITE_DAC_ACCESS
+ *   WRITE_OWNER_ACCESS
+ *   SEC_FLAG_SYSTEM_SECURITY
+ *   READ_CONTROL_ACCESS
+ *
+ * By using O_PATH this can be trimmed down to
+ *
+ *   FILE_READ_DATA
+ *   FILE_WRITE_DATA
+ *   FILE_APPEND_DATA
+ *   FILE_EXECUTE
+ *
+ * Fallback on systems without O_PATH support
+ * ------------------------------------------
+ *
+ * A fallback is needed that allows opening a file-handle with the same
+ * higher level semantics even if the system doesn't support O_PATH. This
+ * is implemented by qimpersonating the root user for the open()
+ * syscall. To avoid bypassing restrictive permissions on intermediate
+ * directories components of a path, the root user is only impersonated
+ * after changing directory to the parent directory of the client
+ * requested pathname.
+ *
+ * In order to avoid privilege escalation security issues with these root
+ * opened file-handles we must carefully control their usage throughout
+ * the codebase. Therefor we
+ *
+ * - tag the pathref fsp's with the flag "is_pathref" and
+ *
+ * - control access to the file-handle by making the structure private and only
+ *   allowing access with accessor functions.
+ *
+ * Two functions are used to fetch the low-level system file-handle from an fsp
+ *
+ * - fsp_get_io_fd(fsp): enforces fsp is NOT a pathref file-handle and
+ *
+ * - fsp_get_pathref_fd(fsp): allows fsp to be either a pathref file-handle or a
+ *   traditional POSIX file-handle opened with O_RDONLY or any other POSIX open
+ *   flag.
+ *
+ * The general guideline when to use which function is:
+ *
+ * - if you do something like fstat(fd), use fsp_get_pathref_fd(fsp),
+ * - if you do something like *at(dirfd, ...), use fsp_get_pathref_fd(fsp),


-- 
Samba Shared Repository


From kseeger at samba.org  Wed Dec 16 12:21:08 2020
From: kseeger at samba.org (Karolin Seeger)
Date: Wed, 16 Dec 2020 12:21:08 +0000
Subject: [SCM] Samba Shared Repository - branch v4-13-stable updated
Message-ID: <E1kpVno-00GlIm-Np@hrx0.samba.org>

The branch, v4-13-stable has been updated
       via  916472aebc9 VERSION: Disable GIT_SNAPSHOT for the 4.13.3 release.
       via  1648eed2470 WHATSNEW: Add release notes for Samba 4.13.3.
       via  670c33fe9cb vfs_zfsacl: add missing inherited flag on hidden "magic" everyone@ ACE
       via  67d42392a31 vfs_zfsacl: reformatting
       via  e3d6d452118 s4/samba: call force_check_log_size() in standard_new_task()
       via  db202fc3efc s4/samba: call force_check_log_size() in standard_accept_connection()
       via  f89daf8d255 s4/samba: call force_check_log_size() in prefork_reload_after_fork()
       via  7258fc076ad s4: call reopen_logs_internal() in the SIGHUP handler of the prefork process model
       via  fa2ea13ec04 s4: replace low-level SIGUP handler with a tevent handler
       via  504c6e03018 s4: install tevent tracing hooks to trigger logfile rotation
       via  69a8fb4f971 s4: add samba server tevent trace helper stuff
       via  80401025504 debug: detect logrotation by checking inode number
       via  e7df21ac640 debug: pass struct debug_class *config to do_one_check_log_size()
       via  39efb02c6b4 debug: pass struct debug_class *config to reopen_one_log()
       via  99ea8cd6dfa loadparm: setup debug subsystem setting max_log_size from config
       via  54d3d3cbf49 s3: smbd: Quiet log messages from usershares for an unknown share.
       via  f7490ec9d94 s3-libads: Pass timeout to open_socket_out in ms
       via  585c49f21f7 vfs_glusterfs: print exact cmdline for disabling write-behind translator
       via  587fa331f62 manpages/vfs_glusterfs: Mention silent skipping of write-behind translator
       via  2ea7b5c43e8 selftest: Remove samba3.blackbox.smbclient_tar from flapping tests
       via  8cec2732890 clitar: Use do_list()'s recursion in clitar.c
       via  2954051aa6d s3/script/tests: Ensure all remote test files are removed
       via  5f1772d94a3 s3/script/tests: call smbclient deltree to remove remote files
       via  257ce5ed541 s3/script/tests: Make smb_client 'die' behaviour configurable
       via  a0ab7adfd78 s3/script/tests: Remove make_path (for remote dir)
       via  c19198e8732 selftest: make samba3.blackbox.smbclient_tar runnable (even manually)
       via  53a91d6cdc0 s3/script/tests: Fix samba3.blackbox.smbclient_tarmode cleanup
       via  896d93091ab s3/script: Use smbclient deltree to clean up smbclient_tarmode subdir
       via  5908aebf364 s3/script/tests: Use tarmode share for samba3.blackbox.smbclient_tar*
       via  5143b487532 s3/script/test: Use different testdir for samba3.blackbox.smbclient_tarmode
       via  7fb13330380 selftest: Add a new tarmode shares
       via  d67c3ea864b s3/script/tests: Fix 'Unrecognized option(s) passed to mkpath()' error
       via  e9b2be96ebc Revert "vfs_ceph: drop fdopendir handler"
       via  441bf80265f smbclient: Fix recursive mget
       via  67364d982d9 test3: Add a test showing that smbclient recursive mget is broken
       via  b4be2f994d1 smbclient: Slightly simplify do_mget()
       via  ddb0d43f0ae smbclient: Remove the "abort_mget" variable
       via  8c82d0fd49b vfs_shadow_copy2: Preserve all open flags assuming ROFS
       via  7e9d27271db s3: spoolss: Make parameters in call to user_ok_token() match all other uses.
       via  61c8a44895e s3: smbd: Don't overwrite contents of fsp->aio_requests[0] with NULL via TALLOC_FREE().
       via  68f19debb74 interface: fix if_index is not parsed correctly
       via  76f07c13cd6 s3: modules: gluster. Fix the error I made in preventing talloc leaks from a function.
       via  c58689c9aad libcli: smb2: Never print length if smb2_signing_key_valid() fails for crypto blob.
       via  4337a6378db s3-vfs_glusterfs: always disable write-behind translator
       via  87b220530b2 VERSION: Bump version up to 4.13.3...
      from  ffef4e947a6 VERSION: Disable GIT_SNAPSHOT for the 4.13.2 release.

https://git.samba.org/?p=samba.git;a=shortlog;h=v4-13-stable


- Log -----------------------------------------------------------------
-----------------------------------------------------------------------

Summary of changes:
 VERSION                                            |   2 +-
 WHATSNEW.txt                                       |  75 +++++++++-
 docs-xml/manpages/vfs_glusterfs.8.xml              |   9 ++
 lib/param/loadparm.c                               |   1 +
 lib/util/debug.c                                   |  63 ++++++---
 libcli/smb/smb2_signing.c                          |   9 +-
 selftest/flapping                                  |   1 -
 selftest/target/Samba3.pm                          |  11 ++
 source3/client/client.c                            | 152 ++++++---------------
 source3/client/clitar.c                            |  41 ++----
 source3/lib/interface.c                            |   2 +-
 source3/libads/ldap.c                              |   4 +-
 source3/modules/vfs_ceph.c                         |  15 +-
 source3/modules/vfs_glusterfs.c                    |  47 +++++--
 source3/modules/vfs_shadow_copy2.c                 |   4 +-
 source3/modules/vfs_zfsacl.c                       |   6 +-
 source3/param/loadparm.c                           |  10 ++
 source3/rpc_server/spoolss/srv_spoolss_nt.c        |   3 +-
 source3/script/tests/test_smbclient_mget.sh        |  39 ++++++
 source3/script/tests/test_smbclient_tarmode.pl     |  62 +++++++--
 source3/script/tests/test_smbclient_tarmode.sh     |  29 ++--
 source3/selftest/tests.py                          |  22 ++-
 source3/smbd/close.c                               |  14 +-
 source3/wscript                                    |   3 +
 source4/smbd/process_prefork.c                     |  16 ++-
 source4/smbd/process_standard.c                    |   4 +
 source4/smbd/server.c                              |  46 +++++++
 source4/smbd/server_util.c                         |  94 +++++++++++++
 .../winbindd_ads.h => source4/smbd/server_util.h   |  18 +--
 source4/smbd/wscript_build                         |   9 +-
 30 files changed, 580 insertions(+), 231 deletions(-)
 create mode 100755 source3/script/tests/test_smbclient_mget.sh
 create mode 100644 source4/smbd/server_util.c
 copy source3/winbindd/winbindd_ads.h => source4/smbd/server_util.h (67%)


Changeset truncated at 500 lines:

diff --git a/VERSION b/VERSION
index 17232cb0574..3ffbca609ac 100644
--- a/VERSION
+++ b/VERSION
@@ -25,7 +25,7 @@
 ########################################################
 SAMBA_VERSION_MAJOR=4
 SAMBA_VERSION_MINOR=13
-SAMBA_VERSION_RELEASE=2
+SAMBA_VERSION_RELEASE=3
 
 ########################################################
 # If a official release has a serious bug              #
diff --git a/WHATSNEW.txt b/WHATSNEW.txt
index a3ce5cc3dd5..947fd89e3c3 100644
--- a/WHATSNEW.txt
+++ b/WHATSNEW.txt
@@ -1,3 +1,74 @@
+                   ==============================
+                   Release Notes for Samba 4.13.3
+                          December 15, 2020
+                   ==============================
+
+
+This is the latest stable release of the Samba 4.13 release series.
+
+
+Changes since 4.13.2
+--------------------
+
+o  Jeremy Allison <jra at samba.org>
+   * BUG 14210: libcli: smb2: Never print length if smb2_signing_key_valid()
+     fails for crypto blob.
+   * BUG 14486: s3: modules: gluster. Fix the error I made in preventing talloc
+     leaks from a function. 
+   * BUG 14515: s3: smbd: Don't overwrite contents of fsp->aio_requests[0] with
+     NULL via TALLOC_FREE().
+   * BUG 14568: s3: spoolss: Make parameters in call to user_ok_token() match
+     all other uses.
+   * BUG 14590: s3: smbd: Quiet log messages from usershares for an unknown
+     share.
+
+o  Ralph Boehme <slow at samba.org>
+   * BUG 14248: samba process does not honor max log size.
+   * BUG 14587: vfs_zfsacl: Add missing inherited flag on hidden "magic"
+     everyone@ ACE.
+
+o  Isaac Boukris <iboukris at gmail.com>
+   * BUG 13124: s3-libads: Pass timeout to open_socket_out in ms.
+
+o  G?nther Deschner <gd at samba.org>
+   * BUG 14486: s3-vfs_glusterfs: Always disable write-behind translator.
+
+o  Volker Lendecke <vl at samba.org>
+   * BUG 14517: smbclient: Fix recursive mget.
+   * BUG 14581: clitar: Use do_list()'s recursion in clitar.c.
+
+o  Anoop C S <anoopcs at samba.org>
+   * BUG 14486: manpages/vfs_glusterfs: Mention silent skipping of write-behind
+     translator.
+   * BUG 14573: vfs_shadow_copy2: Preserve all open flags assuming ROFS.
+
+o  Jones Syue <jonessyue at qnap.com>
+   * BUG 14514: interface: Fix if_index is not parsed correctly.
+
+
+#######################################
+Reporting bugs & Development Discussion
+#######################################
+
+Please discuss this release on the samba-technical mailing list or by
+joining the #samba-technical IRC channel on irc.freenode.net.
+
+If you do report problems then please try to send high quality
+feedback. If you don't provide vital information to help us track down
+the problem then you will probably be ignored.  All bug reports should
+be filed under the Samba 4.1 and newer product in the project's Bugzilla
+database (https://bugzilla.samba.org/).
+
+
+======================================================================
+== Our Code, Our Bugs, Our Responsibility.
+== The Samba Team
+======================================================================
+
+
+Release notes for older releases follow:
+----------------------------------------
+
                    ==============================
                    Release Notes for Samba 4.13.2
                           November 03, 2020
@@ -104,8 +175,8 @@ database (https://bugzilla.samba.org/).
 ======================================================================
 
 
-Release notes for older releases follow:
-----------------------------------------
+----------------------------------------------------------------------
+
 
                    ==============================
                    Release Notes for Samba 4.13.1
diff --git a/docs-xml/manpages/vfs_glusterfs.8.xml b/docs-xml/manpages/vfs_glusterfs.8.xml
index 7a4da1af919..d25135e14ac 100644
--- a/docs-xml/manpages/vfs_glusterfs.8.xml
+++ b/docs-xml/manpages/vfs_glusterfs.8.xml
@@ -179,7 +179,16 @@
                 translator and refuse to connect if detected.
                 Please disable the write-behind translator for the GlusterFS
                 volume to allow the plugin to connect to the volume.
+                The write-behind translator can easily be disabled via calling
+                <programlisting>
+                        gluster volume set &lt;volumename&gt; performance.write-behind off
+                </programlisting> on the commandline.
 	</para>
+        <para>
+                With GlusterFS versions >= 9, we silently bypass write-behind
+                translator during initial connect and failure is avoided.
+        </para>
+
 </refsect1>
 
 
diff --git a/lib/param/loadparm.c b/lib/param/loadparm.c
index e041f4fb01b..006caabc092 100644
--- a/lib/param/loadparm.c
+++ b/lib/param/loadparm.c
@@ -3190,6 +3190,7 @@ static bool lpcfg_update(struct loadparm_context *lp_ctx)
 	settings.debug_pid = lp_ctx->globals->debug_pid;
 	settings.debug_uid = lp_ctx->globals->debug_uid;
 	settings.debug_class = lp_ctx->globals->debug_class;
+	settings.max_log_size = lp_ctx->globals->max_log_size;
 	debug_set_settings(&settings, lp_ctx->globals->logging,
 			   lp_ctx->globals->syslog,
 			   lp_ctx->globals->syslog_only);
diff --git a/lib/util/debug.c b/lib/util/debug.c
index 08ffee35a1f..b19c739d4cd 100644
--- a/lib/util/debug.c
+++ b/lib/util/debug.c
@@ -113,6 +113,8 @@ struct debug_class {
 	 */
 	char *logfile;
 	int fd;
+	/* inode number of the logfile to detect logfile rotation */
+	ino_t ino;
 };
 
 static const char *default_classname_table[] = {
@@ -1082,14 +1084,17 @@ static void debug_callback_log(const char *msg, int msg_level)
  Fix from dgibson at linuxcare.com.
 **************************************************************************/
 
-static bool reopen_one_log(int *fd, const char *logfile)
+static bool reopen_one_log(struct debug_class *config)
 {
-	int old_fd = *fd;
+	int old_fd = config->fd;
+	const char *logfile = config->logfile;
+	struct stat st;
 	int new_fd;
+	int ret;
 
 	if (logfile == NULL) {
 		debug_close_fd(old_fd);
-		*fd = -1;
+		config->fd = -1;
 		return true;
 	}
 
@@ -1104,8 +1109,18 @@ static bool reopen_one_log(int *fd, const char *logfile)
 
 	debug_close_fd(old_fd);
 	smb_set_close_on_exec(new_fd);
-	*fd = new_fd;
+	config->fd = new_fd;
 
+	ret = fstat(new_fd, &st);
+	if (ret != 0) {
+		log_overflow = true;
+		DBG_ERR("Unable to fstat() new log file '%s': %s\n",
+			logfile, strerror(errno));
+		log_overflow = false;
+		return false;
+	}
+
+	config->ino = st.st_ino;
 	return true;
 }
 
@@ -1164,8 +1179,7 @@ bool reopen_logs_internal(void)
 	state.reopening_logs = true;
 
 	for (i = DBGC_ALL; i < debug_num_classes; i++) {
-		ok = reopen_one_log(&dbgc_config[i].fd,
-				    dbgc_config[i].logfile);
+		ok = reopen_one_log(&dbgc_config[i]);
 		if (!ok) {
 			break;
 		}
@@ -1249,51 +1263,62 @@ bool need_to_check_log_size(void)
  Check to see if the log has grown to be too big.
  **************************************************************************/
 
-static void do_one_check_log_size(off_t maxlog, int *_fd, const char *logfile)
+static void do_one_check_log_size(off_t maxlog, struct debug_class *config)
 {
-	char name[strlen(logfile) + 5];
+	char name[strlen(config->logfile) + 5];
 	struct stat st;
-	int fd = *_fd;
 	int ret;
+	bool reopen = false;
 	bool ok;
 
 	if (maxlog == 0) {
 		return;
 	}
 
-	ret = fstat(fd, &st);
+	ret = stat(config->logfile, &st);
 	if (ret != 0) {
 		return;
 	}
-	if (st.st_size < maxlog ) {
+	if (st.st_size >= maxlog ) {
+		reopen = true;
+	}
+
+	if (st.st_ino != config->ino) {
+		reopen = true;
+	}
+
+	if (!reopen) {
 		return;
 	}
 
 	/* reopen_logs_internal() modifies *_fd */
 	(void)reopen_logs_internal();
-	fd = *_fd;
 
-	if (fd <= 2) {
+	if (config->fd <= 2) {
 		return;
 	}
-	ret = fstat(fd, &st);
+	ret = fstat(config->fd, &st);
 	if (ret != 0) {
+		config->ino = (ino_t)0;
 		return;
 	}
+
+	config->ino = st.st_ino;
+
 	if (st.st_size < maxlog) {
 		return;
 	}
 
-	snprintf(name, sizeof(name), "%s.old", logfile);
+	snprintf(name, sizeof(name), "%s.old", config->logfile);
 
-	(void)rename(logfile, name);
+	(void)rename(config->logfile, name);
 
 	ok = reopen_logs_internal();
 	if (ok) {
 		return;
 	}
 	/* We failed to reopen a log - continue using the old name. */
-	(void)rename(name, logfile);
+	(void)rename(name, config->logfile);
 }
 
 static void do_check_log_size(off_t maxlog)
@@ -1307,9 +1332,7 @@ static void do_check_log_size(off_t maxlog)
 		if (dbgc_config[i].logfile == NULL) {
 			continue;
 		}
-		do_one_check_log_size(maxlog,
-				      &dbgc_config[i].fd,
-				      dbgc_config[i].logfile);
+		do_one_check_log_size(maxlog, &dbgc_config[i]);
 	}
 }
 
diff --git a/libcli/smb/smb2_signing.c b/libcli/smb/smb2_signing.c
index 623fc23fb18..cc03607d789 100644
--- a/libcli/smb/smb2_signing.c
+++ b/libcli/smb/smb2_signing.c
@@ -92,8 +92,7 @@ NTSTATUS smb2_signing_sign_pdu(struct smb2_signing_key *signing_key,
 	}
 
 	if (!smb2_signing_key_valid(signing_key)) {
-		DBG_WARNING("Wrong session key length %zu for SMB2 signing\n",
-			    signing_key->blob.length);
+		DBG_WARNING("No signing key for SMB2 signing\n");
 		return NT_STATUS_ACCESS_DENIED;
 	}
 
@@ -416,8 +415,7 @@ NTSTATUS smb2_signing_encrypt_pdu(struct smb2_signing_key *encryption_key,
 	tf = (uint8_t *)vector[0].iov_base;
 
 	if (!smb2_signing_key_valid(encryption_key)) {
-		DBG_WARNING("Wrong encryption key length %zu for SMB2 signing\n",
-			    encryption_key->blob.length);
+		DBG_WARNING("No encryption key for SMB2 signing\n");
 		return NT_STATUS_ACCESS_DENIED;
 	}
 
@@ -613,8 +611,7 @@ NTSTATUS smb2_signing_decrypt_pdu(struct smb2_signing_key *decryption_key,
 	tf = (uint8_t *)vector[0].iov_base;
 
 	if (!smb2_signing_key_valid(decryption_key)) {
-		DBG_WARNING("Wrong decryption key length %zu for SMB2 signing\n",
-			    decryption_key->blob.length);
+		DBG_WARNING("No decryption key for SMB2 signing\n");
 		return NT_STATUS_ACCESS_DENIED;
 	}
 
diff --git a/selftest/flapping b/selftest/flapping
index c9f0adbf1bd..8c3f9e8969a 100644
--- a/selftest/flapping
+++ b/selftest/flapping
@@ -31,6 +31,5 @@
 # This test just is not reliable in finding the max search limit
 #
 ^samba4.ldap.notification.python\(.*\).__main__.LDAPNotificationTest.test_max_search
-^samba3.blackbox.smbclient_tar.* # fails very, very often on sn-devel
 ^samba3.blackbox.smbclient_s3.*.sending a message to the remote server # flakey on sn-devel-104 and sn-devel-144
 ^samba3.blackbox.smbclient_s3.*.creating a good symlink and deleting it by path # flakey on sn-devel-104 and sn-devel-144
diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm
index 0a8cefa811d..e141f102ef1 100755
--- a/selftest/target/Samba3.pm
+++ b/selftest/target/Samba3.pm
@@ -1334,6 +1334,9 @@ sub setup_fileserver
 	my $tarmode_sharedir="$share_dir/tarmode";
 	push(@dirs,$tarmode_sharedir);
 
+	my $tarmode2_sharedir="$share_dir/tarmode2";
+	push(@dirs,$tarmode2_sharedir);
+
 	my $smbcacls_sharedir="$share_dir/smbcacls";
 	push(@dirs,$smbcacls_sharedir);
 
@@ -1362,6 +1365,14 @@ sub setup_fileserver
 
 	get quota command = $prefix_abs/getset_quota.py
 	set quota command = $prefix_abs/getset_quota.py
+[tarmode]
+	path = $tarmode_sharedir
+	comment = tar test share
+	xattr_tdb:file = $prefix_abs/tarmode-xattr.tdb
+[tarmode2]
+	path = $tarmode2_sharedir
+	comment = tar test share
+	xattr_tdb:file = $prefix_abs/tarmode2-xattr.tdb
 [spotlight]
 	path = $share_dir
 	spotlight = yes
diff --git a/source3/client/client.c b/source3/client/client.c
index f65293849d0..8c7ceb644aa 100644
--- a/source3/client/client.c
+++ b/source3/client/client.c
@@ -87,8 +87,6 @@ static char dest_ss_str[INET6_ADDRSTRLEN];
 
 #define SEPARATORS " \t\n\r"
 
-static bool abort_mget = true;
-
 /* timing globals */
 uint64_t get_total_size = 0;
 unsigned int get_total_time_ms = 0;
@@ -1203,12 +1201,10 @@ static NTSTATUS do_mget(struct cli_state *cli_state, struct file_info *finfo,
 		    const char *dir)
 {
 	TALLOC_CTX *ctx = talloc_tos();
-	NTSTATUS status = NT_STATUS_OK;
-	char *rname = NULL;
-	char *quest = NULL;
-	char *saved_curdir = NULL;
-	char *mget_mask = NULL;
-	char *new_cd = NULL;
+	const char *client_cwd = NULL;
+	size_t client_cwd_len;
+	char *path = NULL;
+	char *local_path = NULL;
 
 	if (!finfo->name) {
 		return NT_STATUS_OK;
@@ -1217,121 +1213,63 @@ static NTSTATUS do_mget(struct cli_state *cli_state, struct file_info *finfo,
 	if (strequal(finfo->name,".") || strequal(finfo->name,".."))
 		return NT_STATUS_OK;
 
-	if (abort_mget)	{
-		d_printf("mget aborted\n");
-		return NT_STATUS_UNSUCCESSFUL;
-	}
-
-	if (finfo->attr & FILE_ATTRIBUTE_DIRECTORY) {
-		if (asprintf(&quest,
-			 "Get directory %s? ",finfo->name) < 0) {
-			return NT_STATUS_NO_MEMORY;
-		}
-	} else {
-		if (asprintf(&quest,
-			 "Get file %s? ",finfo->name) < 0) {
-			return NT_STATUS_NO_MEMORY;
-		}
-	}
-
-	if (prompt && !yesno(quest)) {
-		SAFE_FREE(quest);
+	if ((finfo->attr & FILE_ATTRIBUTE_DIRECTORY) && !recurse) {
 		return NT_STATUS_OK;
 	}
-	SAFE_FREE(quest);
 
-	if (!(finfo->attr & FILE_ATTRIBUTE_DIRECTORY)) {
-		rname = talloc_asprintf(ctx,
-				"%s%s",
-				client_get_cur_dir(),
-				finfo->name);
-		if (!rname) {
+	if (prompt) {
+		const char *object = (finfo->attr & FILE_ATTRIBUTE_DIRECTORY) ?
+			"directory" : "file";
+		char *quest = NULL;
+		bool ok;
+
+		quest = talloc_asprintf(
+			ctx, "Get %s %s? ", object, finfo->name);
+		if (quest == NULL) {
 			return NT_STATUS_NO_MEMORY;
 		}
-		rname = client_clean_name(ctx, rname);
-		if (rname == NULL) {
-			return NT_STATUS_NO_MEMORY;
+
+		ok = yesno(quest);
+		TALLOC_FREE(quest);
+		if (!ok) {
+			return NT_STATUS_OK;
 		}
-		do_get(rname, finfo->name, false);
-		TALLOC_FREE(rname);
-		return NT_STATUS_OK;
 	}
 
-	/* handle directories */
-	saved_curdir = talloc_strdup(ctx, client_get_cur_dir());
-	if (!saved_curdir) {
+	path = talloc_asprintf(
+		ctx, "%s%c%s", dir, CLI_DIRSEP_CHAR, finfo->name);
+	if (path == NULL) {
 		return NT_STATUS_NO_MEMORY;
 	}
-
-	new_cd = talloc_asprintf(ctx,
-				"%s%s%s",
-				client_get_cur_dir(),
-				finfo->name,
-				CLI_DIRSEP_STR);
-	if (!new_cd) {
+	path = client_clean_name(ctx, path);
+	if (path == NULL) {
 		return NT_STATUS_NO_MEMORY;
 	}
-	new_cd = client_clean_name(ctx, new_cd);
-	if (new_cd == NULL) {
-		return NT_STATUS_NO_MEMORY;
-	}
-	client_set_cur_dir(new_cd);
-
-	string_replace(finfo->name,'\\','/');
-	if (lowercase) {
-		if (!strlower_m(finfo->name)) {
-			return NT_STATUS_INVALID_PARAMETER;
-		}
-	}
 
-	if (!directory_exist(finfo->name) &&
-	    mkdir(finfo->name,0777) != 0) {
-		d_printf("failed to create directory %s\n",finfo->name);
-		client_set_cur_dir(saved_curdir);
-		return map_nt_error_from_unix(errno);
-	}
-
-	if (chdir(finfo->name) != 0) {
-		d_printf("failed to chdir to directory %s\n",finfo->name);
-		client_set_cur_dir(saved_curdir);
-		return map_nt_error_from_unix(errno);
-	}
-
-	mget_mask = talloc_asprintf(ctx,
-			"%s*",
-			client_get_cur_dir());
+	/*
+	 * Skip the path prefix if we've done a remote "cd" when
+	 * creating the local path
+	 */


-- 
Samba Shared Repository


From asn at samba.org  Wed Dec 16 13:57:01 2020
From: asn at samba.org (Andreas Schneider)
Date: Wed, 16 Dec 2020 13:57:01 +0000
Subject: [SCM] Samba Shared Repository - branch master updated
Message-ID: <E1kpXIb-004Zrq-BX@hrx0.samba.org>

The branch, master has been updated
       via  93c576dae4a auth:creds: Add cli_credentials_dump()
       via  3e61d1ff31b autobuild.py: use --enable-clangdb for the "samba-ctdb" task
       via  df73a766ab6 wafsamba: move clang_compilation_database usage behind an --enable-clangdb option
      from  874c5fcf6da smbd: Remove the smb_fname parameter from set_ea().

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 93c576dae4a2179a253dea4e8969ac435718bda5
Author: Andreas Schneider <asn at samba.org>
Date:   Thu Dec 10 16:48:16 2020 +0100

    auth:creds: Add cli_credentials_dump()
    
    Signed-off-by: Andreas Schneider <asn at samba.org>
    Reviewed-by: Noel Power <noel.power at suse.com>
    
    Autobuild-User(master): Andreas Schneider <asn at cryptomilk.org>
    Autobuild-Date(master): Wed Dec 16 13:56:49 UTC 2020 on sn-devel-184

commit 3e61d1ff31b77a2fc3c2733c90d535a071aab8b5
Author: Stefan Metzmacher <metze at samba.org>
Date:   Tue Dec 15 13:43:22 2020 +0100

    autobuild.py: use --enable-clangdb for the "samba-ctdb" task
    
    The key is that we only enable it for just one task.
    
    I plan to restructure the autobuild tasks, but 'samba-ctdb'
    will stay the way it works currently.
    
    Signed-off-by: Stefan Metzmacher <metze at samba.org>
    Reviewed-by: Andreas Schneider <asn at samba.org>

commit df73a766ab6841e9e21b84fed230c8063bb43019
Author: Stefan Metzmacher <metze at samba.org>
Date:   Tue Dec 15 13:39:40 2020 +0100

    wafsamba: move clang_compilation_database usage behind an --enable-clangdb option
    
    Writing bin/default/compile_commands.json doubles the total time used
    for a noop build. That price should only be paid if someone wants to
    use it actually.
    
    Signed-off-by: Stefan Metzmacher <metze at samba.org>
    Reviewed-by: Andreas Schneider <asn at samba.org>

-----------------------------------------------------------------------

Summary of changes:
 auth/credentials/credentials.c      | 161 ++++++++++++++++++++++++++++++++++++
 auth/credentials/credentials.h      |   2 +
 auth/credentials/tests/test_creds.c |   3 +
 buildtools/wafsamba/samba_utils.py  |   9 +-
 buildtools/wafsamba/samba_waf18.py  |  10 +--
 buildtools/wafsamba/wscript         |  16 ++--
 script/autobuild.py                 |   1 +
 7 files changed, 190 insertions(+), 12 deletions(-)


Changeset truncated at 500 lines:

diff --git a/auth/credentials/credentials.c b/auth/credentials/credentials.c
index 1bdd6f15a09..6596a227bee 100644
--- a/auth/credentials/credentials.c
+++ b/auth/credentials/credentials.c
@@ -1459,6 +1459,167 @@ _PUBLIC_ bool cli_credentials_set_smb_encryption(struct cli_credentials *creds,
 	return false;
 }
 
+static const char *obtained_to_str(enum credentials_obtained obtained)
+{
+	switch (obtained) {
+	case CRED_UNINITIALISED:
+		return "CRED_UNINITIALISED";
+	case CRED_SMB_CONF:
+		return "CRED_SMB_CONF";
+	case CRED_CALLBACK:
+		return "CRED_CALLBACK";
+	case CRED_GUESS_ENV:
+		return "CRED_GUESS_ENV";
+	case CRED_GUESS_FILE:
+		return "CRED_GUESS_FILE";
+	case CRED_CALLBACK_RESULT:
+		return "CRED_CALLBACK_RESULT";
+	case CRED_SPECIFIED:
+		return "CRED_SPECIFIED";
+	}
+
+	/* Never reached */
+	return "";
+}
+
+static const char *krb5_state_to_str(enum credentials_use_kerberos krb5_state)
+{
+	switch (krb5_state) {
+	case CRED_USE_KERBEROS_DISABLED:
+		return "CRED_USE_KERBEROS_DISABLED";
+	case CRED_USE_KERBEROS_DESIRED:
+		return "CRED_USE_KERBEROS_DESIRED";
+	case CRED_USE_KERBEROS_REQUIRED:
+		return "CRED_USE_KERBEROS_REQUIRED";
+	}
+
+	/* Never reached */
+	return "";
+}
+
+static const char *krb5_fwd_to_str(enum credentials_krb_forwardable krb5_fwd)
+{
+	switch (krb5_fwd) {
+	case CRED_AUTO_KRB_FORWARDABLE:
+		return "CRED_AUTO_KRB_FORWARDABLE";
+	case CRED_NO_KRB_FORWARDABLE:
+		return "CRED_NO_KRB_FORWARDABLE";
+	case CRED_FORCE_KRB_FORWARDABLE:
+		return "CRED_FORCE_KRB_FORWARDABLE";
+	}
+
+	/* Never reached */
+	return "";
+}
+
+static const char *signing_state_to_str(enum smb_signing_setting signing_state)
+{
+	switch(signing_state) {
+	case SMB_SIGNING_IPC_DEFAULT:
+		return "SMB_SIGNING_IPC_DEFAULT";
+	case SMB_SIGNING_DEFAULT:
+		return "SMB_SIGNING_DEFAULT";
+	case SMB_SIGNING_OFF:
+		return "SMB_SIGNING_OFF";
+	case SMB_SIGNING_IF_REQUIRED:
+		return "SMB_SIGNING_IF_REQUIRED";
+	case SMB_SIGNING_DESIRED:
+		return "SMB_SIGNING_DESIRED";
+	case SMB_SIGNING_REQUIRED:
+		return "SMB_SIGNING_REQUIRED";
+	}
+
+	/* Never reached */
+	return "";
+}
+
+static const char *encryption_state_to_str(enum smb_encryption_setting encryption_state)
+{
+	switch(encryption_state) {
+	case SMB_ENCRYPTION_DEFAULT:
+		return "SMB_ENCRYPTION_DEFAULT";
+	case SMB_ENCRYPTION_OFF:
+		return "SMB_ENCRYPTION_OFF";
+	case SMB_ENCRYPTION_IF_REQUIRED:
+		return "SMB_ENCRYPTION_IF_REQUIRED";
+	case SMB_ENCRYPTION_DESIRED:
+		return "SMB_ENCRYPTION_DESIRED";
+	case SMB_ENCRYPTION_REQUIRED:
+		return "SMB_ENCRYPTION_REQUIRED";
+	}
+
+	/* Never reached */
+	return "";
+}
+
+_PUBLIC_ void cli_credentials_dump(struct cli_credentials *creds)
+{
+	DBG_ERR("CLI_CREDENTIALS:\n");
+	DBG_ERR("\n");
+	DBG_ERR("  Username: %s - %s\n",
+		creds->username,
+		obtained_to_str(creds->username_obtained));
+	DBG_ERR("  Workstation: %s - %s\n",
+		creds->workstation,
+		obtained_to_str(creds->workstation_obtained));
+	DBG_ERR("  Domain: %s - %s\n",
+		creds->domain,
+		obtained_to_str(creds->domain_obtained));
+	DBG_ERR("  Password: %s - %s\n",
+		creds->password != NULL ? "*SECRET*" : "NULL",
+		obtained_to_str(creds->password_obtained));
+	DBG_ERR("  Old password: %s\n",
+		creds->old_password != NULL ? "*SECRET*" : "NULL");
+	DBG_ERR("  Password tries: %u\n",
+		creds->password_tries);
+	DBG_ERR("  Realm: %s - %s\n",
+		creds->realm,
+		obtained_to_str(creds->realm_obtained));
+	DBG_ERR("  Principal: %s - %s\n",
+		creds->principal,
+		obtained_to_str(creds->principal_obtained));
+	DBG_ERR("  Salt principal: %s\n",
+		creds->salt_principal);
+	DBG_ERR("  Impersonate principal: %s\n",
+		creds->impersonate_principal);
+	DBG_ERR("  Self service: %s\n",
+		creds->self_service);
+	DBG_ERR("  Target service: %s\n",
+		creds->target_service);
+	DBG_ERR("  Kerberos state: %s\n",
+		krb5_state_to_str(creds->use_kerberos));
+	DBG_ERR("  Kerberos forwardable ticket: %s\n",
+		krb5_fwd_to_str(creds->krb_forwardable));
+	DBG_ERR("  Signing state: %s - %s\n",
+		signing_state_to_str(creds->signing_state),
+		obtained_to_str(creds->signing_state_obtained));
+	DBG_ERR("  IPC signing state: %s - %s\n",
+		signing_state_to_str(creds->ipc_signing_state),
+		obtained_to_str(creds->ipc_signing_state_obtained));
+	DBG_ERR("  Encryption state: %s - %s\n",
+		encryption_state_to_str(creds->encryption_state),
+		obtained_to_str(creds->encryption_state_obtained));
+	DBG_ERR("  Gensec features: %#X\n",
+		creds->gensec_features);
+	DBG_ERR("  Forced sasl mech: %s\n",
+		creds->forced_sasl_mech);
+	DBG_ERR("  CCACHE: %p - %s\n",
+		creds->ccache,
+		obtained_to_str(creds->ccache_obtained));
+	DBG_ERR("  CLIENT_GSS_CREDS: %p - %s\n",
+		creds->client_gss_creds,
+		obtained_to_str(creds->client_gss_creds_obtained));
+	DBG_ERR("  SERVER_GSS_CREDS: %p - %s\n",
+		creds->server_gss_creds,
+		obtained_to_str(creds->server_gss_creds_obtained));
+	DBG_ERR("  KEYTAB: %p - %s\n",
+		creds->keytab,
+		obtained_to_str(creds->keytab_obtained));
+	DBG_ERR("  KVNO: %u\n",
+		creds->kvno);
+	DBG_ERR("\n");
+}
+
 /**
  * @brief Obtain the SMB encryption state from a credentials structure.
  *
diff --git a/auth/credentials/credentials.h b/auth/credentials/credentials.h
index f468b8558dd..1fff37e8154 100644
--- a/auth/credentials/credentials.h
+++ b/auth/credentials/credentials.h
@@ -315,6 +315,8 @@ bool cli_credentials_set_smb_encryption(struct cli_credentials *cred,
 enum smb_encryption_setting
 cli_credentials_get_smb_encryption(struct cli_credentials *cred);
 
+void cli_credentials_dump(struct cli_credentials *creds);
+
 /**
  * Return attached NETLOGON credentials 
  */
diff --git a/auth/credentials/tests/test_creds.c b/auth/credentials/tests/test_creds.c
index d2d3d30d73d..f58b11112ea 100644
--- a/auth/credentials/tests/test_creds.c
+++ b/auth/credentials/tests/test_creds.c
@@ -78,6 +78,9 @@ static void torture_creds_init(void **state)
 	assert_int_equal(creds->password_obtained, CRED_SPECIFIED);
 	password = cli_credentials_get_password(creds);
 	assert_string_equal(password, "SECRET");
+
+	/* Run dump to check it works */
+	cli_credentials_dump(creds);
 }
 
 static void torture_creds_init_anonymous(void **state)
diff --git a/buildtools/wafsamba/samba_utils.py b/buildtools/wafsamba/samba_utils.py
index 0587f525aff..e08b55cf71d 100644
--- a/buildtools/wafsamba/samba_utils.py
+++ b/buildtools/wafsamba/samba_utils.py
@@ -459,7 +459,14 @@ def RECURSE(ctx, directory):
         return
     visited_dirs.add(key)
     relpath = os.path.relpath(abspath, ctx.path.abspath())
-    if ctxclass in ['tmp', 'OptionsContext', 'ConfigurationContext', 'BuildContext', 'ClangDbContext']:
+    if ctxclass in ['OptionsContext',
+                    'ConfigurationContext',
+                    'BuildContext',
+                    'CleanContext',
+                    'InstallContext',
+                    'UninstallContext',
+                    'ListContext',
+                    'ClangDbContext']:
         return ctx.recurse(relpath)
     if 'waflib.extras.compat15' in sys.modules:
         return ctx.recurse(relpath)
diff --git a/buildtools/wafsamba/samba_waf18.py b/buildtools/wafsamba/samba_waf18.py
index ecf3891f175..e2a078bd3a0 100644
--- a/buildtools/wafsamba/samba_waf18.py
+++ b/buildtools/wafsamba/samba_waf18.py
@@ -5,7 +5,6 @@ from waflib import Build, Configure, Node, Utils, Options, Logs, TaskGen
 from waflib import ConfigSet
 from waflib.TaskGen import feature, after
 from waflib.Configure import conf, ConfigurationContext
-from waflib.extras import clang_compilation_database
 
 from waflib.Tools.flex import decide_ext
 
@@ -37,10 +36,11 @@ TaskGen.declare_chain(
     decider = decide_ext,
 )
 
-
-for y in (Build.BuildContext, Build.CleanContext, Build.InstallContext, Build.UninstallContext, Build.ListContext, clang_compilation_database.ClangDbContext):
-    class tmp(y):
-        variant = 'default'
+Build.BuildContext.variant = 'default'
+Build.CleanContext.variant = 'default'
+Build.InstallContext.variant = 'default'
+Build.UninstallContext.variant = 'default'
+Build.ListContext.variant = 'default'
 
 def abspath(self, env=None):
     if env and hasattr(self, 'children'):
diff --git a/buildtools/wafsamba/wscript b/buildtools/wafsamba/wscript
index 65cc8d3cd5e..1aadb9570e1 100644
--- a/buildtools/wafsamba/wscript
+++ b/buildtools/wafsamba/wscript
@@ -132,6 +132,9 @@ def options(opt):
         action="store_true",
         dest='undefined_sanitizer',
         default=False)
+    gr.add_option('--enable-clangdb',
+                   help=("Enable use of clang_compilation_database"),
+                   action="store_true", dest='enable_clangdb', default=False)
     gr.add_option('--enable-libfuzzer',
                   help=("Build fuzzing binaries (use ADDITIONAL_CFLAGS to specify compiler options for libFuzzer or use CC=honggfuzz/hfuzz-cc)"),
                   action="store_true", dest='enable_libfuzzer', default=False)
@@ -657,12 +660,13 @@ struct foo bar = { .y = 'X', .x = 1 };
         conf.DEFINE('FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION', 1)
         conf.env.FUZZ_TARGET_LDFLAGS = Options.options.FUZZ_TARGET_LDFLAGS
 
-    conf.load('clang_compilation_database')
-
-    # Create a symlink of the compile db for clangd
-    symlink(os.path.join(conf.bldnode.abspath(), 'default/compile_commands.json'),
-            os.path.join(conf.srcnode.abspath(), 'compile_commands.json'),
-            force=True)
+    conf.env.enable_clangdb = Options.options.enable_clangdb
+    if conf.env.enable_clangdb:
+        conf.load('clang_compilation_database')
+        # Create a symlink of the compile db for clangd
+        symlink(os.path.join(conf.bldnode.abspath(), 'default/compile_commands.json'),
+                os.path.join(conf.srcnode.abspath(), 'compile_commands.json'),
+                force=True)
 
     conf.SAMBA_BUILD_ENV()
 
diff --git a/script/autobuild.py b/script/autobuild.py
index 00ba8d727b0..444bc156f48 100755
--- a/script/autobuild.py
+++ b/script/autobuild.py
@@ -620,6 +620,7 @@ tasks = {
          "PKG_CONFIG_PATH=${PREFIX_DIR}/lib/pkgconfig:${PKG_CONFIG_PATH} "
          "./configure.developer ${PREFIX} "
          "--with-selftest-prefix=./bin/ab "
+         "--enable-clangdb "
          "--with-cluster-support "
          "--without-ad-dc "
          "--bundled-libraries=!tdb"),


-- 
Samba Shared Repository


From abartlet at samba.org  Thu Dec 17 00:55:01 2020
From: abartlet at samba.org (Andrew Bartlett)
Date: Thu, 17 Dec 2020 00:55:01 +0000
Subject: [SCM] Samba Shared Repository - branch master updated
Message-ID: <E1kphZN-00GnSd-D4@hrx0.samba.org>

The branch, master has been updated
       via  8004cf7a4af pep8 tidy up config
       via  1ed461a142f tests python krb5: initial TGS tests
       via  0f232ed42fb tests python krb5: add test base class
       via  d74c9dcf3aa tests python krb5: Add Authorization data ad-type constants
      from  93c576dae4a auth:creds: Add cli_credentials_dump()

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 8004cf7a4aff8f5a8615bc68c0e61d5bd5de039b
Author: Gary Lockyer <gary at catalyst.net.nz>
Date:   Wed Dec 16 10:56:22 2020 +1300

    pep8 tidy up config
    
    Enable the following warnings:
    
    E126: continuation line over-indented for hanging indent
    E131: continuation line unaligned for hanging indent
    E203: whitespace before ':'
    E221: multiple spaces before operator
    E501: line too long
    E722: do not use bare 'except'
    
    These were originally chosen so that as much of the existing samba code
    passed. With the intention of integrating PEP8 checking into build
    process.  But the PEP8 output does not integrate into the known fail
    mechanism, so this approach was abandoned.
    
    setup.cfg is the default PEP8 config file having these exceptions
    enabled means that new code can be added with those issues. Also tools
    like pyls (python language server) use setup.cfg.
    
    Disable the following warnings:
    
    E402: module level import not at top of file
          Samba has a significant amount of code setting
          sys.path.insert(0, "bin/python")
    W503: Line break before binary operator
          We need to have a preference, and PEP8 expresses a weak preference
          for disabling 503
    
    Signed-off-by: Gary Lockyer <gary at catalyst.net.nz>
    Reviewed-by: Andrew Bartlett <abartlet at samba.org>
    Reviewed-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
    
    Autobuild-User(master): Andrew Bartlett <abartlet at samba.org>
    Autobuild-Date(master): Thu Dec 17 00:54:51 UTC 2020 on sn-devel-184

commit 1ed461a142f68f5de5e21b873ebddfcf5ae0ca1e
Author: Gary Lockyer <gary at catalyst.net.nz>
Date:   Mon Nov 30 14:19:15 2020 +1300

    tests python krb5: initial TGS tests
    
    Initial tests on the KDC TGS
    
    Signed-off-by: Gary Lockyer <gary at catalyst.net.nz>
    Reviewed-by: Andrew Bartlett <abartlet at samba.org>

commit 0f232ed42fb2671d025643cafb19891373562e4a
Author: Gary Lockyer <gary at catalyst.net.nz>
Date:   Mon Nov 30 14:16:28 2020 +1300

    tests python krb5: add test base class
    
    Add a base class for the KDC tests to reduce the amount of code
    duplication in  the tests.
    
    Signed-off-by: Gary Lockyer <gary at catalyst.net.nz>
    Reviewed-by: Andrew Bartlett <abartlet at samba.org>

commit d74c9dcf3aaa613abfac49288f427484468bf6e1
Author: Gary Lockyer <gary at catalyst.net.nz>
Date:   Thu Dec 10 10:15:28 2020 +1300

    tests python krb5: Add Authorization data ad-type constants
    
    Add constants for the Authorization Data Type values.
    RFC 4120 7.5.4.  Authorization Data Types
    
    Signed-off-by: Gary Lockyer <gary at catalyst.net.nz>
    Reviewed-by: Andrew Bartlett <abartlet at samba.org>

-----------------------------------------------------------------------

Summary of changes:
 python/samba/tests/krb5/kdc_base_test.py     | 418 +++++++++++++++++++++++++++
 python/samba/tests/krb5/kdc_tgs_tests.py     | 210 ++++++++++++++
 python/samba/tests/krb5/rfc4120_constants.py |  16 +
 python/samba/tests/usage.py                  |   2 +
 selftest/knownfail_mit_kdc                   |   5 +
 setup.cfg                                    |  12 +-
 source4/selftest/tests.py                    |   3 +
 7 files changed, 658 insertions(+), 8 deletions(-)
 create mode 100644 python/samba/tests/krb5/kdc_base_test.py
 create mode 100755 python/samba/tests/krb5/kdc_tgs_tests.py


Changeset truncated at 500 lines:

diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py
new file mode 100644
index 00000000000..1a823d173e3
--- /dev/null
+++ b/python/samba/tests/krb5/kdc_base_test.py
@@ -0,0 +1,418 @@
+# Unix SMB/CIFS implementation.
+# Copyright (C) Stefan Metzmacher 2020
+# Copyright (C) 2020 Catalyst.Net Ltd
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+import sys
+import os
+
+sys.path.insert(0, "bin/python")
+os.environ["PYTHONUNBUFFERED"] = "1"
+from collections import namedtuple
+from ldb import SCOPE_BASE
+from samba import generate_random_password
+from samba.auth import system_session
+from samba.credentials import Credentials
+from samba.dcerpc import krb5pac
+from samba.dsdb import UF_WORKSTATION_TRUST_ACCOUNT, UF_NORMAL_ACCOUNT
+from samba.ndr import ndr_unpack
+from samba.samdb import SamDB
+
+from samba.tests import delete_force
+from samba.tests.krb5.raw_testcase import RawKerberosTest
+import samba.tests.krb5.rfc4120_pyasn1 as krb5_asn1
+from samba.tests.krb5.rfc4120_constants import (
+    AD_IF_RELEVANT,
+    AD_WIN2K_PAC,
+    KDC_ERR_PREAUTH_REQUIRED,
+    KRB_AS_REP,
+    KRB_TGS_REP,
+    KRB_ERROR,
+    PADATA_ENC_TIMESTAMP,
+    PADATA_ETYPE_INFO2,
+)
+
+global_asn1_print = False
+global_hexdump = False
+
+
+class KDCBaseTest(RawKerberosTest):
+    """ Base class for KDC tests.
+    """
+
+    @classmethod
+    def setUpClass(cls):
+        cls.lp = cls.get_loadparm(cls)
+        cls.username = os.environ["USERNAME"]
+        cls.password = os.environ["PASSWORD"]
+        cls.host = os.environ["SERVER"]
+
+        c = Credentials()
+        c.set_username(cls.username)
+        c.set_password(cls.password)
+        try:
+            realm = os.environ["REALM"]
+            c.set_realm(realm)
+        except KeyError:
+            pass
+        try:
+            domain = os.environ["DOMAIN"]
+            c.set_domain(domain)
+        except KeyError:
+            pass
+
+        c.guess()
+
+        cls.credentials = c
+
+        cls.session = system_session()
+        cls.ldb = SamDB(url="ldap://%s" % cls.host,
+                        session_info=cls.session,
+                        credentials=cls.credentials,
+                        lp=cls.lp)
+        # fetch the dnsHostName from the RootDse
+        res = cls.ldb.search(
+            base="", expression="", scope=SCOPE_BASE, attrs=["dnsHostName"])
+        cls.dns_host_name = str(res[0]['dnsHostName'])
+
+    def setUp(self):
+        super().setUp()
+        self.do_asn1_print = global_asn1_print
+        self.do_hexdump = global_hexdump
+        self.accounts = []
+
+    def tearDown(self):
+        # Clean up any accounts created by create_account
+        for dn in self.accounts:
+            delete_force(self.ldb, dn)
+
+    def create_account(self, name, machine_account=False, spn=None):
+        '''Create an account for testing.
+           The dn of the created account is added to self.accounts,
+           which is used by tearDown to clean up the created accounts.
+        '''
+        dn = "cn=%s,%s" % (name, self.ldb.domain_dn())
+
+        # remove the account if it exists, this will happen if a previous test
+        # run failed
+        delete_force(self.ldb, dn)
+        if machine_account:
+            object_class = "computer"
+            account_name = "%s$" % name
+            account_control = str(UF_WORKSTATION_TRUST_ACCOUNT)
+        else:
+            object_class = "user"
+            account_name = name
+            account_control = str(UF_NORMAL_ACCOUNT)
+
+        password = generate_random_password(32, 32)
+        utf16pw = ('"%s"' % password).encode('utf-16-le')
+
+        details = {
+            "dn": dn,
+            "objectclass": object_class,
+            "sAMAccountName": account_name,
+            "userAccountControl": account_control,
+            "unicodePwd": utf16pw}
+        if spn is not None:
+            details["servicePrincipalName"] = spn
+        self.ldb.add(details)
+
+        creds = Credentials()
+        creds.guess(self.lp)
+        creds.set_realm(self.ldb.domain_dns_name().upper())
+        creds.set_domain(self.ldb.domain_netbios_name().upper())
+        creds.set_password(password)
+        creds.set_username(account_name)
+        if machine_account:
+            creds.set_workstation(name)
+        #
+        # Save the account name so it can be deleted in the tearDown
+        self.accounts.append(dn)
+
+        return (creds, dn)
+
+    def as_req(self, cname, sname, realm, etypes, padata=None):
+        '''Send a Kerberos AS_REQ, returns the undecoded response
+        '''
+
+        till = self.get_KerberosTime(offset=36000)
+        kdc_options = 0
+
+        req = self.AS_REQ_create(padata=padata,
+                                 kdc_options=str(kdc_options),
+                                 cname=cname,
+                                 realm=realm,
+                                 sname=sname,
+                                 from_time=None,
+                                 till_time=till,
+                                 renew_time=None,
+                                 nonce=0x7fffffff,
+                                 etypes=etypes,
+                                 addresses=None,
+                                 EncAuthorizationData=None,
+                                 EncAuthorizationData_key=None,
+                                 additional_tickets=None)
+        rep = self.send_recv_transaction(req)
+        return rep
+
+    def get_as_rep_key(self, creds, rep):
+        '''Extract the session key from an AS-REP
+        '''
+        rep_padata = self.der_decode(
+            rep['e-data'],
+            asn1Spec=krb5_asn1.METHOD_DATA())
+
+        for pa in rep_padata:
+            if pa['padata-type'] == PADATA_ETYPE_INFO2:
+                padata_value = pa['padata-value']
+                break
+
+        etype_info2 = self.der_decode(
+            padata_value, asn1Spec=krb5_asn1.ETYPE_INFO2())
+
+        key = self.PasswordKey_from_etype_info2(creds, etype_info2[0])
+        return key
+
+    def get_pa_data(self, creds, rep, skew=0):
+        '''generate the pa_data data element for an AS-REQ
+        '''
+        key = self.get_as_rep_key(creds, rep)
+
+        (patime, pausec) = self.get_KerberosTimeWithUsec(offset=skew)
+        padata = self.PA_ENC_TS_ENC_create(patime, pausec)
+        padata = self.der_encode(padata, asn1Spec=krb5_asn1.PA_ENC_TS_ENC())
+
+        usage = 1
+        padata = self.EncryptedData_create(key, usage, padata)
+        padata = self.der_encode(padata, asn1Spec=krb5_asn1.EncryptedData())
+
+        padata = self.PA_DATA_create(PADATA_ENC_TIMESTAMP, padata)
+
+        return [padata]
+
+    def get_as_rep_enc_data(self, key, rep):
+        ''' Decrypt and Decode the encrypted data in an AS-REP
+        '''
+        usage = 3
+        enc_part = key.decrypt(usage, rep['enc-part']['cipher'])
+        # MIT KDC encodes both EncASRepPart and EncTGSRepPart with
+        # application tag 26
+        try:
+            enc_part = self.der_decode(
+                enc_part, asn1Spec=krb5_asn1.EncASRepPart())
+        except Exception:
+            enc_part = self.der_decode(
+                enc_part, asn1Spec=krb5_asn1.EncTGSRepPart())
+
+        return enc_part
+
+    def check_pre_authenication(self, rep):
+        """ Check that the kdc response was pre-authentication required
+        """
+        self.check_error_rep(rep, KDC_ERR_PREAUTH_REQUIRED)
+
+    def check_as_reply(self, rep):
+        """ Check that the kdc response is an AS-REP and that the
+            values for:
+                msg-type
+                pvno
+                tkt-pvno
+                kvno
+            match the expected values
+        """
+
+        # Should have a reply, and it should an AS-REP message.
+        self.assertIsNotNone(rep)
+        self.assertEqual(rep['msg-type'], KRB_AS_REP, "rep = {%s}" % rep)
+
+        # Protocol version number should be 5
+        pvno = int(rep['pvno'])
+        self.assertEqual(5, pvno, "rep = {%s}" % rep)
+
+        # The ticket version number should be 5
+        tkt_vno = int(rep['ticket']['tkt-vno'])
+        self.assertEqual(5, tkt_vno, "rep = {%s}" % rep)
+
+        # Check that the kvno is not an RODC kvno
+        # MIT kerberos does not provide the kvno, so we treat it as optional.
+        # This is tested in compatability_test.py
+        if 'kvno' in rep['enc-part']:
+            kvno = int(rep['enc-part']['kvno'])
+            # If the high order bits are set this is an RODC kvno.
+            self.assertEqual(0, kvno & 0xFFFF0000, "rep = {%s}" % rep)
+
+    def check_tgs_reply(self, rep):
+        """ Check that the kdc response is an TGS-REP and that the
+            values for:
+                msg-type
+                pvno
+                tkt-pvno
+                kvno
+            match the expected values
+        """
+
+        # Should have a reply, and it should an TGS-REP message.
+        self.assertIsNotNone(rep)
+        self.assertEqual(rep['msg-type'], KRB_TGS_REP, "rep = {%s}" % rep)
+
+        # Protocol version number should be 5
+        pvno = int(rep['pvno'])
+        self.assertEqual(5, pvno, "rep = {%s}" % rep)
+
+        # The ticket version number should be 5
+        tkt_vno = int(rep['ticket']['tkt-vno'])
+        self.assertEqual(5, tkt_vno, "rep = {%s}" % rep)
+
+        # Check that the kvno is not an RODC kvno
+        # MIT kerberos does not provide the kvno, so we treat it as optional.
+        # This is tested in compatability_test.py
+        if 'kvno' in rep['enc-part']:
+            kvno = int(rep['enc-part']['kvno'])
+            # If the high order bits are set this is an RODC kvno.
+            self.assertEqual(0, kvno & 0xFFFF0000, "rep = {%s}" % rep)
+
+    def check_error_rep(self, rep, expected):
+        """ Check that the reply is an error message, with the expected
+            error-code specified.
+        """
+        self.assertIsNotNone(rep)
+        self.assertEqual(rep['msg-type'], KRB_ERROR, "rep = {%s}" % rep)
+        self.assertEqual(rep['error-code'], expected, "rep = {%s}" % rep)
+
+    def tgs_req(self, cname, sname, realm, ticket, key, etypes):
+        '''Send a TGS-REQ, returns the response and the decrypted and
+           decoded enc-part
+        '''
+
+        kdc_options = "0"
+        till = self.get_KerberosTime(offset=36000)
+        padata = []
+
+        subkey = self.RandomKey(key.etype)
+        subkey_usage = 9
+
+        (ctime, cusec) = self.get_KerberosTimeWithUsec()
+
+        req = self.TGS_REQ_create(padata=padata,
+                                  cusec=cusec,
+                                  ctime=ctime,
+                                  ticket=ticket,
+                                  kdc_options=str(kdc_options),
+                                  cname=cname,
+                                  realm=realm,
+                                  sname=sname,
+                                  from_time=None,
+                                  till_time=till,
+                                  renew_time=None,
+                                  nonce=0x7ffffffe,
+                                  etypes=etypes,
+                                  addresses=None,
+                                  EncAuthorizationData=None,
+                                  EncAuthorizationData_key=None,
+                                  additional_tickets=None,
+                                  ticket_session_key=key,
+                                  authenticator_subkey=subkey)
+        rep = self.send_recv_transaction(req)
+        self.assertIsNotNone(rep)
+
+        msg_type = rep['msg-type']
+        enc_part = None
+        if msg_type == KRB_TGS_REP:
+            enc_part = subkey.decrypt(subkey_usage, rep['enc-part']['cipher'])
+            enc_part = self.der_decode(
+                enc_part, asn1Spec=krb5_asn1.EncTGSRepPart())
+        return (rep, enc_part)
+
+    # Named tuple to contain values of interest when the PAC is decoded.
+    PacData = namedtuple(
+        "PacData",
+        "account_name account_sid logon_name upn domain_name")
+    PAC_LOGON_INFO = 1
+    PAC_CREDENTIAL_INFO = 2
+    PAC_SRV_CHECKSUM = 6
+    PAC_KDC_CHECKSUM = 7
+    PAC_LOGON_NAME = 10
+    PAC_CONSTRAINED_DELEGATION = 11
+    PAC_UPN_DNS_INFO = 12
+
+    def get_pac_data(self, authorization_data):
+        '''Decode the PAC element contained in the authorization-data element
+        '''
+        account_name = None
+        user_sid = None
+        logon_name = None
+        upn = None
+        domain_name = None
+
+        # The PAC data will be wrapped in an AD_IF_RELEVANT element
+        ad_if_relevant_elements = (
+            x for x in authorization_data if x['ad-type'] == AD_IF_RELEVANT)
+        for dt in ad_if_relevant_elements:
+            buf = self.der_decode(
+                dt['ad-data'], asn1Spec=krb5_asn1.AD_IF_RELEVANT())
+            # The PAC data is further wrapped in a AD_WIN2K_PAC element
+            for ad in (x for x in buf if x['ad-type'] == AD_WIN2K_PAC):
+                pb = ndr_unpack(krb5pac.PAC_DATA, ad['ad-data'])
+                for pac in pb.buffers:
+                    if pac.type == self.PAC_LOGON_INFO:
+                        account_name = (
+                            pac.info.info.info3.base.account_name)
+                        user_sid = (
+                            str(pac.info.info.info3.base.domain_sid) +
+                            "-" + str(pac.info.info.info3.base.rid))
+                    elif pac.type == self.PAC_LOGON_NAME:
+                        logon_name = pac.info.account_name
+                    elif pac.type == self.PAC_UPN_DNS_INFO:
+                        upn = pac.info.upn_name
+                        domain_name = pac.info.dns_domain_name
+
+        return self.PacData(
+            account_name,
+            user_sid,
+            logon_name,
+            upn,
+            domain_name)
+
+    def decode_service_ticket(self, creds, ticket):
+        '''Decrypt and decode a service ticket
+        '''
+
+        name = creds.get_username()
+        if name.endswith('$'):
+            name = name[:-1]
+        realm = creds.get_realm()
+        salt = "%s.%s@%s" % (name, realm.lower(), realm.upper())
+
+        key = self.PasswordKey_create(
+            ticket['enc-part']['etype'],
+            creds.get_password(),
+            salt,
+            ticket['enc-part']['kvno'])
+
+        enc_part = key.decrypt(2, ticket['enc-part']['cipher'])
+        enc_ticket_part = self.der_decode(
+            enc_part, asn1Spec=krb5_asn1.EncTicketPart())
+        return enc_ticket_part
+
+    def get_objectSid(self, dn):
+        ''' Get the objectSID for a DN
+            Note: performs an Ldb query.
+        '''
+        res = self.ldb.search(dn, scope=SCOPE_BASE, attrs=["objectSID"])
+        self.assertTrue(len(res) == 1, "did not get objectSid for %s" % dn)
+        sid = self.ldb.schema_format_value("objectSID", res[0]["objectSID"][0])
+        return sid.decode('utf8')
diff --git a/python/samba/tests/krb5/kdc_tgs_tests.py b/python/samba/tests/krb5/kdc_tgs_tests.py
new file mode 100755
index 00000000000..23a1d868a79
--- /dev/null
+++ b/python/samba/tests/krb5/kdc_tgs_tests.py
@@ -0,0 +1,210 @@
+#!/usr/bin/env python3
+# Unix SMB/CIFS implementation.
+# Copyright (C) Stefan Metzmacher 2020
+# Copyright (C) 2020 Catalyst.Net Ltd
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+import sys
+import os
+
+sys.path.insert(0, "bin/python")
+os.environ["PYTHONUNBUFFERED"] = "1"
+
+from samba.tests.krb5.kdc_base_test import KDCBaseTest
+from samba.tests.krb5.rfc4120_constants import (
+    AES256_CTS_HMAC_SHA1_96,
+    ARCFOUR_HMAC_MD5,
+    KRB_ERROR,
+    KDC_ERR_BADMATCH,
+    NT_PRINCIPAL,
+    NT_SRV_INST,
+)
+
+global_asn1_print = False
+global_hexdump = False
+
+
+class KdcTgsTests(KDCBaseTest):
+
+    def setUp(self):
+        super().setUp()
+        self.do_asn1_print = global_asn1_print
+        self.do_hexdump = global_hexdump
+
+    def test_tgs_req_cname_does_not_not_match_authenticator_cname(self):
+        ''' Try and obtain a ticket from the TGS, but supply a cname
+            that differs from that provided to the krbtgt
+        '''
+        # Create the user account
+        user_name = "tsttktusr"
+        (uc, _) = self.create_account(user_name)
+        realm = uc.get_realm().lower()
+
+        # Do the initial AS-REQ, should get a pre-authentication required
+        # response
+        etype = (AES256_CTS_HMAC_SHA1_96,)
+        cname = self.PrincipalName_create(
+            name_type=NT_PRINCIPAL, names=[user_name])
+        sname = self.PrincipalName_create(
+            name_type=NT_SRV_INST, names=["krbtgt", realm])
+
+        rep = self.as_req(cname, sname, realm, etype)
+        self.check_pre_authenication(rep)
+
+        # Do the next AS-REQ
+        padata = self.get_pa_data(uc, rep)
+        key = self.get_as_rep_key(uc, rep)
+        rep = self.as_req(cname, sname, realm, etype, padata=padata)


-- 
Samba Shared Repository


From metze at samba.org  Thu Dec 17 15:02:01 2020
From: metze at samba.org (Stefan Metzmacher)
Date: Thu, 17 Dec 2020 15:02:01 +0000
Subject: [SCM] Samba Shared Repository - branch master updated
Message-ID: <E1kpun3-0052yc-Id@hrx0.samba.org>

The branch, master has been updated
       via  6c95e467817 smbd/notify: add option "honor change notify privilege"
       via  bcfce0ecd31 selftest: add tests for smb notify, using the a special share
       via  3e9f0e97255 selftest: add option to pass args to tests to planpythontestsuite()
       via  0133c17c099 python/tests: add tests for smb notify and the dependency to the TRAVERSE privilege
       via  f4e578aa24b python/ntacls.py: add SMBHelper.set_acl() helper function
       via  b082cf321e4 python/ntacls.py: let SMBHelper.get_acl() use the default values of self.smb_conn.get_acl()
       via  18dd953d83a libsmb_samba_internal: calculate the access_mask for {g,s}et_acl() based on the secinfo flags
       via  0ccdce67d3a libsmb_samba_internal: don't send SECINFO_[UN]PROTECTED_{S,D}ACL by default
       via  752a8f870de s3:pylibsmb: remove unused SECINFO_DEFAULT_FLAGS
       via  3ffb817506c s3:pylibsmb: add notify() support
       via  fde65c2f293 s3:pylibsmb: add echo() support
       via  084c22403f0 s3:pylibsmb: PyErr_NTSTATUS_IS_ERR_RAISE => PyErr_NTSTATUS_NOT_OK_RAISE
       via  560e4b1b32f libcli/smb: add smbXcli_conn_send_queue()
       via  76121ae7cf4 s3:libsmb: set correct min and max smb protocol when smb2 is enforced on connect
       via  f40da74e145 s3:libsmb: set min smb protocol when enforcing smb1 on connect
       via  98119189cfe blackbox/test_samba-tool_ntacl.sh: script requires two arguments
       via  577d4f1a60c docs:smbdotconf: fix a typo in oldpasswordallowedperiod.xml
      from  8004cf7a4af pep8 tidy up config

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 6c95e467817b246a0eab626cac10b6120f6c88f8
Author: Bj?rn Baumbach <bb at sernet.de>
Date:   Tue Nov 6 15:21:37 2018 +0100

    smbd/notify: add option "honor change notify privilege"
    
    This option can be used to make use of the change notify privilege.
    By default notify results are not checked against the file system
    permissions.
    
    If "honor change notify privilege" is enabled, a user will only
    receive notify results, if he has change notify privilege or sufficient
    file system permissions. If a user has the change notify privilege, he
    will receive all requested notify results, even if the user does not
    have the permissions on the file system.
    
    Pair-Programmed-With: Stefan Metzmacher <metze at samba.org>
    
    Signed-off-by: Bj?rn Baumbach <bb at sernet.de>
    Signed-off-by: Stefan Metzmacher <metze at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>
    
    Autobuild-User(master): Stefan Metzmacher <metze at samba.org>
    Autobuild-Date(master): Thu Dec 17 15:01:53 UTC 2020 on sn-devel-184

commit bcfce0ecd3153d158f712ff548a1ccd005031bc8
Author: Bj?rn Baumbach <bb at sernet.de>
Date:   Mon Jul 20 16:49:39 2020 +0200

    selftest: add tests for smb notify, using the a special share
    
    That share will get the "honor change notify privilege = yes" option
    once it's implemented. For now it's marked as knownfail.
    
    Pair-Programmed-With: Stefan Metzmacher <metze at samba.org>
    
    Signed-off-by: Bj?rn Baumbach <bb at sernet.de>
    Signed-off-by: Stefan Metzmacher <metze at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 3e9f0e97255de1b4235c4dca6912635386328746
Author: Bj?rn Baumbach <bb at sernet.de>
Date:   Fri Jul 24 12:18:11 2020 +0200

    selftest: add option to pass args to tests to planpythontestsuite()
    
    The logic is basically a copy from planoldpythontestsuite().
    
    Pair-Programmed-With: Stefan Metzmacher <metze at samba.org>
    
    Signed-off-by: Bj?rn Baumbach <bb at sernet.de>
    Signed-off-by: Stefan Metzmacher <metze at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 0133c17c099f6a482e2941a2254c983ec0188592
Author: Bj?rn Baumbach <bb at sernet.de>
Date:   Mon Jul 20 16:49:39 2020 +0200

    python/tests: add tests for smb notify and the dependency to the TRAVERSE privilege
    
    The easiest way to run this against Windows was to use a domain
    controller and configure an enforce group policy and grant the
    "Bypass Traverse Checking" only to the "BUILTIN\Administrators" group.
    (Note that "LOCAL SERVICE" and "NETWORK SERVICE" are always added in
    the local security policy.
    
    The test runs like this:
    
      SMB_CONF_PATH=/dev/null \
      SERVER=172.31.9.188 \
      TARGET_HOSTNAME=w2012r2-188.w2012r2-l6.base \
      USERNAME=administrator \
      PASSWORD=A1b2C3d4 \
      NOTIFY_SHARE=torture \
      USERNAME_UNPRIV=ldaptestuser \
      PASSWORD_UNPRIV=a1B2c3D4 \
      python/samba/tests/smb-notify.py -v -f SMBNotifyTests
    
    Pair-Programmed-With: Stefan Metzmacher <metze at samba.org>
    
    Signed-off-by: Bj?rn Baumbach <bb at sernet.de>
    Signed-off-by: Stefan Metzmacher <metze at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit f4e578aa24bc020d87716915ea5037d7677b75e9
Author: Bj?rn Baumbach <bb at sernet.de>
Date:   Tue Jul 21 12:34:19 2020 +0200

    python/ntacls.py: add SMBHelper.set_acl() helper function
    
    Pair-Programmed-With: Stefan Metzmacher <metze at samba.org>
    
    Signed-off-by: Bj?rn Baumbach <bb at sernet.de>
    Signed-off-by: Stefan Metzmacher <metze at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit b082cf321e4267cc214f2a74550847585275e25a
Author: Stefan Metzmacher <metze at samba.org>
Date:   Thu Dec 3 13:59:58 2020 +0100

    python/ntacls.py: let SMBHelper.get_acl() use the default values of self.smb_conn.get_acl()
    
    Now that self.smb_conn.get_acl() has sane default values for secinfo and
    access_mask we can remove any additional logic in SMBHelper.
    
    The resulting values are the same.
    
    Signed-off-by: Stefan Metzmacher <metze at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 18dd953d83a5d43b243047d9dd622620034ee6c7
Author: Stefan Metzmacher <metze at samba.org>
Date:   Thu Dec 3 14:51:52 2020 +0100

    libsmb_samba_internal: calculate the access_mask for {g,s}et_acl() based on the secinfo flags
    
    SEC_FLAG_MAXIMUM_ALLOWED will never result in SEC_FLAG_SYSTEM_SECURITY
    being granted. As SECINFO_SACL is part of the default secinfo value
    (SECINFO_DEFAULT_FLAGS), {g,s}et_acl() will always return
    NT_STATUS_ACCESS_DENIED by default.
    
    Signed-off-by: Stefan Metzmacher <metze at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 0ccdce67d3adfc06b6d8235b53d677da1526ba4b
Author: Stefan Metzmacher <metze at samba.org>
Date:   Thu Dec 3 13:58:53 2020 +0100

    libsmb_samba_internal: don't send SECINFO_[UN]PROTECTED_{S,D}ACL by default
    
    We want to get the default behavior.
    
    It's also pointless to set PROTECTED and UNPROTECTED at the same time.
    These are defined in MS-DTYP 2.4.7 SECURITY_INFORMATION with a brief
    description, but they aren't referenced in anywhere in MS-DTYP itself,
    nor in MS-FSA are any other document.
    
    Signed-off-by: Stefan Metzmacher <metze at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 752a8f870de2bb087802a1287d7fb6c7624ac631
Author: Stefan Metzmacher <metze at samba.org>
Date:   Thu Dec 3 13:19:58 2020 +0100

    s3:pylibsmb: remove unused SECINFO_DEFAULT_FLAGS
    
    commit 42be033b0b0c02413a74f984c8622b5baed2689a removed the last
    reference.
    
    Signed-off-by: Stefan Metzmacher <metze at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 3ffb817506c032cdc05064abfbffb9f364e09a22
Author: Stefan Metzmacher <metze at samba.org>
Date:   Tue Aug 27 13:49:04 2019 +0000

    s3:pylibsmb: add notify() support
    
    The operation is a bit different from others,
    as results are returned in an async fashion.
    It returns a request handle.
    
      notify_req = conn.notify(fnum=fnum,
                               buffer_size=0xffff,
                               completion_filter=libsmb.FILE_NOTIFY_CHANGE_ALL,
                               recursive=True)
    
      # ... do other operations on conn.*() ...
    
      changes = notify_req.get_changes(wait=False)
      # changes is likely to be None if no result arrived yet
    
      # ... do other operations on conn.*() ...
    
      changes = notify_req.get_changes(wait=True)
      # changes is a list of change dictionaries
      # each containing "name" (a string) and
      # "action" (an integer, e.g. libsmb.NOTIFY_ACTION_REMOVED)
    
    Signed-off-by: Stefan Metzmacher <metze at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit fde65c2f293ae3038c0052ea9d0dcdf3261d3fbc
Author: Stefan Metzmacher <metze at samba.org>
Date:   Mon Dec 7 17:52:49 2020 +0100

    s3:pylibsmb: add echo() support
    
    In tests it's sometimes to have a no-op in order to check the
    transport is still alive.
    
    Signed-off-by: Stefan Metzmacher <metze at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 084c22403f0042f9cb6c5af6651cc9ef8b5f3bd0
Author: Stefan Metzmacher <metze at samba.org>
Date:   Wed Dec 9 10:13:54 2020 +0100

    s3:pylibsmb: PyErr_NTSTATUS_IS_ERR_RAISE => PyErr_NTSTATUS_NOT_OK_RAISE
    
    We want to raise an exception for everything that's not NT_STATUS_OK.
    
    Signed-off-by: Stefan Metzmacher <metze at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 560e4b1b32f56ed4cfffc60efd9199ed435409ba
Author: Stefan Metzmacher <metze at samba.org>
Date:   Thu Aug 29 10:28:14 2019 +0000

    libcli/smb: add smbXcli_conn_send_queue()
    
    This is useful in order to test async requests
    tevent_queue_wait_send/recv() can be used to block
    the queue between requests or wait for the queue to be flushed.
    
    Signed-off-by: Stefan Metzmacher <metze at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 76121ae7cf4967329b9745137999fde00309c987
Author: Bj?rn Baumbach <bb at sernet.de>
Date:   Thu Aug 29 12:13:50 2019 +0200

    s3:libsmb: set correct min and max smb protocol when smb2 is enforced on connect
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14105
    
    Pair-programmed-with: Stefan Metzmacher <metze at samba.org>
    
    Signed-off-by: Bj?rn Baumbach <bb at sernet.de>
    Signed-off-by: Stefan Metzmacher <metze at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit f40da74e1452e73799f8643d93b8b9e572df1088
Author: Bj?rn Baumbach <bb at sernet.de>
Date:   Wed Aug 28 14:11:02 2019 +0200

    s3:libsmb: set min smb protocol when enforcing smb1 on connect
    
    Otherwise the connect fails if the configured client min protocol is
    higher than NT1.
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14105
    
    Signed-off-by: Bj?rn Baumbach <bb at sernet.de>
    Reviewed-by: Stefan Metzmacher <metze at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 98119189cfe7b76322253d30170528eb0bf33eb7
Author: Bj?rn Baumbach <bb at sernet.de>
Date:   Tue Aug 27 11:19:42 2019 +0200

    blackbox/test_samba-tool_ntacl.sh: script requires two arguments
    
    Signed-off-by: Bj?rn Baumbach <bb at sernet.de>
    Reviewed-by: Stefan Metzmacher <metze at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 577d4f1a60c41df82da8711dabde9361780a9144
Author: Bj?rn Baumbach <bb at sernet.de>
Date:   Wed Mar 18 10:31:04 2020 +0100

    docs:smbdotconf: fix a typo in oldpasswordallowedperiod.xml
    
    Signed-off-by: Bj?rn Baumbach <bb at sernet.de>
    Reviewed-by: Stefan Metzmacher <metze at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

-----------------------------------------------------------------------

Summary of changes:
 .../smbdotconf/misc/honorchangenotifyprivilege.xml |  20 +
 .../security/oldpasswordallowedperiod.xml          |   2 +-
 libcli/smb/smbXcli_base.c                          |   5 +
 libcli/smb/smbXcli_base.h                          |   1 +
 python/samba/ntacls.py                             |  28 +-
 python/samba/samba3/libsmb_samba_internal.py       |  83 +++-
 python/samba/tests/smb-notify.py                   | 430 +++++++++++++++++++++
 python/samba/tests/usage.py                        |   1 +
 selftest/selftesthelpers.py                        |  16 +-
 selftest/target/Samba3.pm                          |   4 +
 source3/libsmb/cliconnect.c                        |  11 +-
 source3/libsmb/pylibsmb.c                          | 309 ++++++++++++++-
 source3/param/loadparm.c                           |   1 +
 source3/smbd/notify.c                              | 129 +++++++
 source4/selftest/tests.py                          |   8 +
 testprogs/blackbox/test_samba-tool_ntacl.sh        |   8 +-
 16 files changed, 1008 insertions(+), 48 deletions(-)
 create mode 100644 docs-xml/smbdotconf/misc/honorchangenotifyprivilege.xml
 create mode 100755 python/samba/tests/smb-notify.py


Changeset truncated at 500 lines:

diff --git a/docs-xml/smbdotconf/misc/honorchangenotifyprivilege.xml b/docs-xml/smbdotconf/misc/honorchangenotifyprivilege.xml
new file mode 100644
index 00000000000..a9c880ce467
--- /dev/null
+++ b/docs-xml/smbdotconf/misc/honorchangenotifyprivilege.xml
@@ -0,0 +1,20 @@
+<samba:parameter name="honor change notify privilege"
+                 context="S"
+                 type="boolean"
+                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
+<description>
+	<para>
+	  This option can be used to make use of the change notify privilege.
+	  By default notify results are not checked against the file system
+	  permissions.
+	</para>
+	<para>
+	  If "honor change notify privilege" is enabled, a user will only
+	  receive notify results, if he has change notify privilege or
+	  sufficient file system permissions. If a user has the change notify
+	  privilege, he will receive all requested notify results, even if the
+	  user does not have the permissions on the file system.
+	</para>
+</description>
+<value type="default">no</value>
+</samba:parameter>
diff --git a/docs-xml/smbdotconf/security/oldpasswordallowedperiod.xml b/docs-xml/smbdotconf/security/oldpasswordallowedperiod.xml
index 9cb607b11b3..78d6ff1d609 100644
--- a/docs-xml/smbdotconf/security/oldpasswordallowedperiod.xml
+++ b/docs-xml/smbdotconf/security/oldpasswordallowedperiod.xml
@@ -5,7 +5,7 @@
 <description>
     <para>Number of minutes to permit an NTLM login after a password change or reset using the old password.  This allows the user to re-cache the new password on multiple clients without disrupting a network reconnection in the meantime. </para>
 
-    <para>This parameter only applies when <smbconfoption name="server role"/> is set to Active Directory Domain Controller</para>
+    <para>This parameter only applies when <smbconfoption name="server role"/> is set to Active Directory Domain Controller.</para>
 </description>
 
 <value type="default">60</value>
diff --git a/libcli/smb/smbXcli_base.c b/libcli/smb/smbXcli_base.c
index df80be6bf16..0fc4aa4451a 100644
--- a/libcli/smb/smbXcli_base.c
+++ b/libcli/smb/smbXcli_base.c
@@ -2743,6 +2743,11 @@ NTSTATUS smb1cli_req_chain_submit(struct tevent_req **reqs, int num_reqs)
 	return NT_STATUS_OK;
 }
 
+struct tevent_queue *smbXcli_conn_send_queue(struct smbXcli_conn *conn)
+{
+	return conn->outgoing;
+}
+
 bool smbXcli_conn_has_async_calls(struct smbXcli_conn *conn)
 {
 	return ((tevent_queue_length(conn->outgoing) != 0)
diff --git a/libcli/smb/smbXcli_base.h b/libcli/smb/smbXcli_base.h
index db5f5d58799..d9c3175bdf5 100644
--- a/libcli/smb/smbXcli_base.h
+++ b/libcli/smb/smbXcli_base.h
@@ -43,6 +43,7 @@ struct smbXcli_conn *smbXcli_conn_create(TALLOC_CTX *mem_ctx,
 bool smbXcli_conn_is_connected(struct smbXcli_conn *conn);
 void smbXcli_conn_disconnect(struct smbXcli_conn *conn, NTSTATUS status);
 
+struct tevent_queue *smbXcli_conn_send_queue(struct smbXcli_conn *conn);
 bool smbXcli_conn_has_async_calls(struct smbXcli_conn *conn);
 
 bool smbXcli_conn_dfs_supported(struct smbXcli_conn *conn);
diff --git a/python/samba/ntacls.py b/python/samba/ntacls.py
index 0dcf958f727..4f189965d05 100644
--- a/python/samba/ntacls.py
+++ b/python/samba/ntacls.py
@@ -49,12 +49,6 @@ SECURITY_SECINFO_FLAGS = security.SECINFO_OWNER | \
                          security.SECINFO_DACL  | \
                          security.SECINFO_SACL
 
-
-# SEC_FLAG_SYSTEM_SECURITY is required otherwise get Access Denied
-SECURITY_SEC_FLAGS = security.SEC_FLAG_SYSTEM_SECURITY | \
-                     security.SEC_STD_READ_CONTROL
-
-
 class XattrBackendError(Exception):
     """A generic xattr backend error."""
 
@@ -335,14 +329,30 @@ class SMBHelper:
         self.smb_conn = smb_conn
         self.dom_sid = dom_sid
 
-    def get_acl(self, smb_path, as_sddl=False):
+    def get_acl(self, smb_path, as_sddl=False,
+                sinfo=None, access_mask=None):
         assert '/' not in smb_path
 
-        ntacl_sd = self.smb_conn.get_acl(
-            smb_path, SECURITY_SECINFO_FLAGS, SECURITY_SEC_FLAGS)
+        ntacl_sd = self.smb_conn.get_acl(smb_path,
+                                         sinfo=sinfo,
+                                         access_mask=access_mask)
 
         return ntacl_sd.as_sddl(self.dom_sid) if as_sddl else ntacl_sd
 
+    def set_acl(self, smb_path, ntacl_sd,
+                sinfo=None, access_mask=None):
+        assert '/' not in smb_path
+
+        assert(isinstance(ntacl_sd, str) or isinstance(ntacl_sd, security.descriptor))
+        if isinstance(ntacl_sd, str):
+            tmp_desc = security.descriptor.from_sddl(ntacl_sd, self.domain_sid)
+        elif isinstance(ntacl_sd, security.descriptor):
+            tmp_desc = ntacl_sd
+
+        self.smb_conn.set_acl(smb_path, tmp_desc,
+                              sinfo=sinfo,
+                              access_mask=access_mask)
+
     def list(self, smb_path=''):
         """
         List file and dir base names in smb_path without recursive.
diff --git a/python/samba/samba3/libsmb_samba_internal.py b/python/samba/samba3/libsmb_samba_internal.py
index 84729b2041d..ef0b30d774b 100644
--- a/python/samba/samba3/libsmb_samba_internal.py
+++ b/python/samba/samba3/libsmb_samba_internal.py
@@ -29,17 +29,77 @@ class Conn(LibsmbCConn):
         security.SECINFO_OWNER | \
         security.SECINFO_GROUP | \
         security.SECINFO_DACL | \
-        security.SECINFO_PROTECTED_DACL | \
-        security.SECINFO_UNPROTECTED_DACL | \
-        security.SECINFO_SACL | \
-        security.SECINFO_PROTECTED_SACL | \
-        security.SECINFO_UNPROTECTED_SACL
+        security.SECINFO_SACL
+
+    def required_access_for_get_secinfo(self, secinfo):
+        access = 0
+
+        #
+        # This is based on MS-FSA
+        # 2.1.5.13 Server Requests a Query of Security Information
+        #
+        # Note that MS-SMB2 3.3.5.20.3 Handling SMB2_0_INFO_SECURITY
+        # doesn't specify any extra checks
+        #
+
+        if secinfo & security.SECINFO_OWNER:
+            access |= security.SEC_STD_READ_CONTROL
+        if secinfo & security.SECINFO_GROUP:
+            access |= security.SEC_STD_READ_CONTROL
+        if secinfo & security.SECINFO_DACL:
+            access |= security.SEC_STD_READ_CONTROL
+        if secinfo & security.SECINFO_SACL:
+            access |= security.SEC_FLAG_SYSTEM_SECURITY
+
+        if secinfo & security.SECINFO_LABEL:
+            access |= security.SEC_STD_READ_CONTROL
+
+        return access
+
+    def required_access_for_set_secinfo(self, secinfo):
+        access = 0
+
+        #
+        # This is based on MS-FSA
+        # 2.1.5.16 Server Requests Setting of Security Information
+        # and additional constraints from
+        # MS-SMB2 3.3.5.21.3 Handling SMB2_0_INFO_SECURITY
+        #
+
+        if secinfo & security.SECINFO_OWNER:
+            access |= security.SEC_STD_WRITE_OWNER
+        if secinfo & security.SECINFO_GROUP:
+            access |= security.SEC_STD_WRITE_OWNER
+        if secinfo & security.SECINFO_DACL:
+            access |= security.SEC_STD_WRITE_DAC
+        if secinfo & security.SECINFO_SACL:
+            access |= security.SEC_FLAG_SYSTEM_SECURITY
+
+        if secinfo & security.SECINFO_LABEL:
+            access |= security.SEC_STD_WRITE_OWNER
+
+        if secinfo & security.SECINFO_ATTRIBUTE:
+            access |= security.SEC_STD_WRITE_DAC
+
+        if secinfo & security.SECINFO_SCOPE:
+            access |= security.SEC_FLAG_SYSTEM_SECURITY
+
+        if secinfo & security.SECINFO_BACKUP:
+            access |= security.SEC_STD_WRITE_OWNER
+            access |= security.SEC_STD_WRITE_DAC
+            access |= security.SEC_FLAG_SYSTEM_SECURITY
+
+        return access
 
     def get_acl(self,
                 filename,
-                sinfo = SECINFO_DEFAULT_FLAGS,
-                access_mask = security.SEC_FLAG_MAXIMUM_ALLOWED):
+                sinfo=None,
+                access_mask=None):
         """Get security descriptor for file."""
+        if sinfo is None:
+            sinfo = self.SECINFO_DEFAULT_FLAGS
+        if access_mask is None:
+            access_mask = self.required_access_for_get_secinfo(sinfo)
         fnum = self.create(
             Name=filename,
             DesiredAccess=access_mask,
@@ -53,11 +113,16 @@ class Conn(LibsmbCConn):
     def set_acl(self,
                 filename,
                 sd,
-                sinfo = SECINFO_DEFAULT_FLAGS):
+                sinfo=None,
+                access_mask=None):
         """Set security descriptor for file."""
+        if sinfo is None:
+            sinfo = self.SECINFO_DEFAULT_FLAGS
+        if access_mask is None:
+            access_mask = self.required_access_for_set_secinfo(sinfo)
         fnum = self.create(
             Name=filename,
-            DesiredAccess=security.SEC_FLAG_MAXIMUM_ALLOWED,
+            DesiredAccess=access_mask,
             ShareAccess=(FILE_SHARE_READ|FILE_SHARE_WRITE))
         try:
             self.set_sd(fnum, sd, sinfo)
diff --git a/python/samba/tests/smb-notify.py b/python/samba/tests/smb-notify.py
new file mode 100755
index 00000000000..2f42263be25
--- /dev/null
+++ b/python/samba/tests/smb-notify.py
@@ -0,0 +1,430 @@
+#!/usr/bin/env python3
+# Unix SMB/CIFS implementation. Tests for smb notify
+# Copyright (C) Bj?rn Baumbach <bb at samba.org> 2020
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import sys
+import os
+
+sys.path.insert(0, "bin/python")
+os.environ["PYTHONUNBUFFERED"] = "1"
+
+import samba
+import random
+from samba.tests import TestCase
+from samba import NTSTATUSError
+from samba import credentials
+from samba.ntstatus import NT_STATUS_NOTIFY_CLEANUP
+from samba.samba3 import libsmb_samba_internal as libsmb
+from samba.samba3 import param as s3param
+from samba.dcerpc import security
+
+from samba import ntacls
+
+test_dir = os.path.join('notify_test_%d' % random.randint(0, 0xFFFF))
+
+class SMBNotifyTests(TestCase):
+    def setUp(self):
+        super(SMBNotifyTests, self).setUp()
+        self.server = samba.tests.env_get_var_value("SERVER")
+
+        # create an SMB connection to the server
+        self.lp = s3param.get_context()
+        self.lp.load(samba.tests.env_get_var_value("SMB_CONF_PATH"))
+
+        self.share = samba.tests.env_get_var_value("NOTIFY_SHARE")
+
+        creds = credentials.Credentials()
+        creds.guess(self.lp)
+        creds.set_username(samba.tests.env_get_var_value("USERNAME"))
+        creds.set_password(samba.tests.env_get_var_value("PASSWORD"))
+
+        strict_checking = samba.tests.env_get_var_value('STRICT_CHECKING', allow_missing=True)
+        if strict_checking is None:
+            strict_checking = '1'
+        self.strict_checking = bool(int(strict_checking))
+
+        self.smb_conn = libsmb.Conn(self.server, self.share, self.lp, creds)
+        self.smb_conn_unpriv = None
+
+        try:
+            self.smb_conn.deltree(test_dir)
+        except:
+            pass
+        self.smb_conn.mkdir(test_dir)
+
+    def connect_unpriv(self):
+        creds_unpriv = credentials.Credentials()
+        creds_unpriv.guess(self.lp)
+        creds_unpriv.set_username(samba.tests.env_get_var_value("USERNAME_UNPRIV"))
+        creds_unpriv.set_password(samba.tests.env_get_var_value("PASSWORD_UNPRIV"))
+
+        self.smb_conn_unpriv = libsmb.Conn(self.server, self.share, self.lp, creds_unpriv)
+
+    def tearDown(self):
+        super(SMBNotifyTests, self).tearDown()
+        try:
+            self.smb_conn.deltree(test_dir)
+        except:
+            pass
+
+    def make_path(self, dirpath, filename):
+        return os.path.join(dirpath, filename).replace('/', '\\')
+
+    def test_notify(self):
+        # setup notification request on the share root
+        root_fnum = self.smb_conn.create(Name="", ShareAccess=1)
+        root_notify = self.smb_conn.notify(fnum=root_fnum,
+                                           buffer_size=0xffff,
+                                           completion_filter=libsmb.FILE_NOTIFY_CHANGE_ALL,
+                                           recursive=True)
+        # setup notification request on the test_dir
+        test_dir_fnum = self.smb_conn.create(Name=test_dir, ShareAccess=1)
+        test_dir_notify = self.smb_conn.notify(fnum=test_dir_fnum,
+                                               buffer_size=0xffff,
+                                               completion_filter=libsmb.FILE_NOTIFY_CHANGE_ALL,
+                                               recursive=True)
+
+        # make sure we didn't receive any changes yet.
+        self.smb_conn.echo()
+        changes = root_notify.get_changes(wait=False)
+        self.assertIsNone(changes)
+        changes = test_dir_notify.get_changes(wait=False)
+        self.assertIsNone(changes)
+
+        # create a test directory
+        dir_name = "dir"
+        dir_path = self.make_path(test_dir, dir_name)
+        self.smb_conn.mkdir(dir_path)
+
+        # check for 'added' notifications
+        changes = root_notify.get_changes(wait=True)
+        self.assertIsNotNone(changes)
+        self.assertEqual(changes[0]['name'], dir_path)
+        self.assertEqual(changes[0]['action'], libsmb.NOTIFY_ACTION_ADDED)
+        self.assertEqual(len(changes), 1)
+        changes = test_dir_notify.get_changes(wait=True)
+        self.assertIsNotNone(changes)
+        self.assertEqual(changes[0]['name'], dir_name)
+        self.assertEqual(changes[0]['action'], libsmb.NOTIFY_ACTION_ADDED)
+        self.assertEqual(len(changes), 1)
+
+        # readd notification requests
+        root_notify = self.smb_conn.notify(fnum=root_fnum,
+                                           buffer_size=0xffff,
+                                           completion_filter=libsmb.FILE_NOTIFY_CHANGE_ALL,
+                                           recursive=True)
+        test_dir_notify = self.smb_conn.notify(fnum=test_dir_fnum,
+                                               buffer_size=0xffff,
+                                               completion_filter=libsmb.FILE_NOTIFY_CHANGE_ALL,
+                                               recursive=True)
+
+        # make sure we didn't receive any changes yet.
+        self.smb_conn.echo()
+        changes = root_notify.get_changes(wait=False)
+        self.assertIsNone(changes)
+        changes = test_dir_notify.get_changes(wait=False)
+        self.assertIsNone(changes)
+
+        # create subdir and trigger notifications
+        sub_name = "subdir"
+        sub_path_rel = self.make_path(dir_name, sub_name)
+        sub_path_full = self.make_path(dir_path, sub_name)
+        self.smb_conn.mkdir(sub_path_full)
+
+        # check for 'added' notifications
+        changes = root_notify.get_changes(wait=True)
+        self.assertIsNotNone(changes)
+        self.assertEqual(changes[0]['name'], sub_path_full)
+        self.assertEqual(changes[0]['action'], libsmb.NOTIFY_ACTION_ADDED)
+        self.assertEqual(len(changes), 1)
+        changes = test_dir_notify.get_changes(wait=True)
+        self.assertIsNotNone(changes)
+        self.assertEqual(changes[0]['name'], sub_path_rel)
+        self.assertEqual(changes[0]['action'], libsmb.NOTIFY_ACTION_ADDED)
+        self.assertEqual(len(changes), 1)
+
+        # readd notification requests
+        root_notify = self.smb_conn.notify(fnum=root_fnum,
+                                           buffer_size=0xffff,
+                                           completion_filter=libsmb.FILE_NOTIFY_CHANGE_ALL,
+                                           recursive=True)
+        test_dir_notify = self.smb_conn.notify(fnum=test_dir_fnum,
+                                               buffer_size=0xffff,
+                                               completion_filter=libsmb.FILE_NOTIFY_CHANGE_ALL,
+                                               recursive=True)
+
+        # make sure we didn't receive any changes yet.
+        self.smb_conn.echo()
+        changes = root_notify.get_changes(wait=False)
+        self.assertIsNone(changes)
+        changes = test_dir_notify.get_changes(wait=False)
+        self.assertIsNone(changes)
+
+        # remove test dir and trigger notifications
+        self.smb_conn.rmdir(sub_path_full)
+
+        # check for 'removed' notifications
+        changes = root_notify.get_changes(wait=True)
+        self.assertIsNotNone(changes)
+        self.assertEqual(changes[0]['name'], sub_path_full)
+        self.assertEqual(changes[0]['action'], libsmb.NOTIFY_ACTION_REMOVED)
+        self.assertEqual(len(changes), 1)
+        changes = test_dir_notify.get_changes(wait=True)
+        self.assertIsNotNone(changes)
+        self.assertEqual(changes[0]['name'], sub_path_rel)
+        self.assertEqual(changes[0]['action'], libsmb.NOTIFY_ACTION_REMOVED)
+        self.assertEqual(len(changes), 1)
+
+        # readd notification requests
+        root_notify = self.smb_conn.notify(fnum=root_fnum,
+                                           buffer_size=0xffff,
+                                           completion_filter=libsmb.FILE_NOTIFY_CHANGE_ALL,
+                                           recursive=True)
+        test_dir_notify = self.smb_conn.notify(fnum=test_dir_fnum,
+                                               buffer_size=0xffff,
+                                               completion_filter=libsmb.FILE_NOTIFY_CHANGE_ALL,
+                                               recursive=True)
+
+        # make sure we didn't receive any changes yet.
+        self.smb_conn.echo()
+        changes = root_notify.get_changes(wait=False)
+        self.assertIsNone(changes)
+        changes = test_dir_notify.get_changes(wait=False)
+        self.assertIsNone(changes)
+
+        # closing the handle on test_dir will trigger
+        # a NOTIFY_CLEANUP on test_dir_notify and
+        # it also seems to update something on test_dir it self
+        # and post a MODIFIED on root_notify
+        #
+        # TODO: find out why windows generates ACTION_MODIFIED
+        #       and why Samba doesn't
+        self.smb_conn.close(test_dir_fnum)
+        try:
+            changes = test_dir_notify.get_changes(wait=True)
+            self.fail()
+        except samba.NTSTATUSError as err:
+            self.assertEqual(err.args[0], NT_STATUS_NOTIFY_CLEANUP)
+        self.smb_conn.echo()
+        changes = root_notify.get_changes(wait=False)
+        if self.strict_checking:
+            self.assertIsNotNone(changes)
+        if changes is not None:
+            self.assertEqual(changes[0]['name'], test_dir)
+            self.assertEqual(changes[0]['action'], libsmb.NOTIFY_ACTION_MODIFIED)
+            self.assertEqual(len(changes), 1)
+
+            # readd notification request
+            root_notify = self.smb_conn.notify(fnum=root_fnum,
+                                               buffer_size=0xffff,
+                                               completion_filter=libsmb.FILE_NOTIFY_CHANGE_ALL,
+                                               recursive=True)
+
+        # make sure we didn't receive any changes yet.
+        self.smb_conn.echo()
+        changes = root_notify.get_changes(wait=False)
+        self.assertIsNone(changes)
+
+        # remove test_dir
+        self.smb_conn.rmdir(dir_path)
+
+        # check for 'removed' notifications
+        changes = root_notify.get_changes(wait=True)
+        self.assertIsNotNone(changes)
+        self.assertEqual(changes[0]['name'], dir_path)
+        self.assertEqual(changes[0]['action'], libsmb.NOTIFY_ACTION_REMOVED)
+        self.assertEqual(len(changes), 1)
+
+        # readd notification request
+        root_notify = self.smb_conn.notify(fnum=root_fnum,
+                                           buffer_size=0xffff,
+                                           completion_filter=libsmb.FILE_NOTIFY_CHANGE_ALL,
+                                           recursive=True)
+        # closing the handle on test_dir will trigger
+        # a NOTIFY_CLEANUP on root_notify
+        self.smb_conn.close(root_fnum)
+        try:
+            changes = root_notify.get_changes(wait=True)
+            self.fail()
+        except samba.NTSTATUSError as err:
+            self.assertEqual(err.args[0], NT_STATUS_NOTIFY_CLEANUP)
+
+
+    def _test_notify_privileged_path(self,
+                                     monitor_path=None,
+                                     rel_prefix=None):


-- 
Samba Shared Repository


From jra at samba.org  Thu Dec 17 20:05:02 2020
From: jra at samba.org (Jeremy Allison)
Date: Thu, 17 Dec 2020 20:05:02 +0000
Subject: [SCM] Samba Shared Repository - branch master updated
Message-ID: <E1kpzWI-00H9o4-31@hrx0.samba.org>

The branch, master has been updated
       via  a77de71ced0 vfs_acl_tdb: avoid deleting the NT ACL from the tdb
       via  25ec2881727 vfs_acl_xattr: avoid removing the ACL xattr
       via  e6b0797caff vfs_acl_common: add an fsp extension when setting ACL
       via  498831cf66b vfs_acl_common: add and use a function exit label
       via  d860785f68c vfs_acl_xattr: reformatting
       via  92b14995423 vfs: RIP SMB_VFS_SYS_ACL_SET_FILE()
       via  6efe41c49cb posix_acls: use pathref fsp in copy_access_posix_acl()
       via  24a46b9db95 smbd: use pathref fsp in change_dir_owner_to_parent()
       via  74b9080668c smbd: use a real dirfsp/atname in mkdir_internal() with SMB_VFS_MKDIRAT()
       via  43b5e97ad96 smbd: after creating a directory, open the fsp as pathref fsp
       via  83ffeac7163 smbd: pass fsp to mkdir_internal()
       via  405d11642b6 smbd: open a pathref fsp on the parent directory
       via  621793733dc vfs_time_audit: support real dirfsps in smb_time_audit_mkdirat()
       via  cf07a5cd456 vfs_full_audit: support real dirfsps in smb_full_audit_mkdirat()
       via  a6f35e89d00 vfs_shadow_copy2: support real dirfsps in shadow_copy2_mkdirat()
       via  c3fb27d92b8 smbd: check for absolute paths in full_path_from_dirfsp_atname()
       via  71a614861a5 vfs_linux_xfs_sgid: support real dirfsps in linux_xfs_sgid_mkdirat()
       via  640629b21ba vfs_glusterfs: support real dirfsps in vfs_gluster_mkdirat()
       via  cb3d8b20def vfs_audit: support real dirfsps in audit_mkdirat()
       via  6c79c2f2e82 vfs_extd_audit: support real dirfsps in audit_mkdirat()
       via  dc4c952807f vfs_xattr_tdb: support real dirfsps in xattr_tdb_mkdirat()
       via  875fd6eec25 vfs_media_harmony: support real dirfsps in mh_mkdirat()
       via  2d57908f139 vfs_syncops: support real dirfsps in syncops_mkdirat()
       via  9bafb894033 vfs_unityed_media: support real dirfsps in um_mkdirat()
       via  3dee234e25e vfs_default: remove assert from vfswrap_mkdirat()
       via  b54158fb72d smbd: move mode logic out of vfswrap_mkdirat() to the caller mkdir_internal()
       via  1af5892a985 pysmbd: use SMB_VFS_SYS_ACL_SET_FD() in set_sys_acl_conn()
       via  33cbe40c419 posix_acls: use SMB_VFS_SYS_ACL_SET_FD() in set_unix_posix_default_acl()
       via  8d323aebe34 posix_acls: use SMB_VFS_SYS_ACL_SET_FD() in set_canon_ace_list()
       via  1f4426b44e1 vfs_default: add support for SMB_ACL_TYPE_DEFAULT and pathref fsps in vfswrap_sys_acl_set_fd()
       via  ee0a6d228ab vfs_aixacl2: handle pathref fsps in aixjfs2_sys_acl_set_fd()
       via  f4c2f867f03 vfs_aixacl: handle pathref fsps in aixacl_sys_acl_set_fd()
       via  fc6ee68c290 vfs_vxfs: add support for SMB_ACL_TYPE_DEFAULT in vxfs_sys_acl_set_fd()
       via  9303683ee28 vfs_tru64acl: add support for SMB_ACL_TYPE_DEFAULT to tru64acl_sys_acl_set_fd()
       via  7d9a9993cc7 vfs_solarisacl: add support for SMB_ACL_TYPE_DEFAULT in solarisacl_sys_acl_set_fd()
       via  bf369327dbf vfs_posixacl: support SMB_ACL_TYPE_DEFAULT in posixacl_sys_acl_set_fd()
       via  ba07df5e0d9 vfs_gpfs: add support for SMB_ACL_TYPE_DEFAULT in gpfsacl_sys_acl_set_fd()
       via  a866027e41b vfs_fake_acls: add support for SMB_ACL_TYPE_DEFAULT in fake_acls_sys_acl_set_fd()
       via  6c30d49f480 vfs_aixacl2: use ACL type in aixjfs2_sys_acl_set_fd()
       via  3363cddc3a7 vfs_aixacl: use passed in ACL type in aixacl_sys_acl_set_fd()
       via  467dbdbdde3 posixacl_xattr: add support for SMB_ACL_TYPE_DEFAULT in posixacl_xattr_acl_set_fd()
       via  8d0ea8bafa0 vfs: add acl type arg to SMB_VFS_SYS_ACL_SET_FD()
       via  ebf37cfc3cb smbd: remove fd_close() from open_directory()
       via  de806498603 smbd: Ensure close_directory() and close_normal_file() only deal with is_fsa files.
       via  7c5476baadb smbd: mark fsp as valid FSA fsp after Durable Handle reconnect succeeded
       via  59b0fae26e1 smbd: Move closing a print file out of close_normal_file() (it isn't a normal file) and into close_file().
       via  12dd02d884d smbd: On error exit in create_file_unixpath(), we can't call close_file() on uncompleted opens.
       via  e7f1588ee49 smbd: If an smb_filename already has a pathref fsp don't overwrite it.
       via  8559af63169 smbd: dup_file_fsp() for old DOS style opens also needs to copy the new flags.
       via  cbe1485f7b2 smbd: Fix debugs in file_new() and fsp_new().
      from  6c95e467817 smbd/notify: add option "honor change notify privilege"

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit a77de71ced013604382e5c62a904db0fbf1cdd81
Author: Ralph Boehme <slow at samba.org>
Date:   Wed Dec 16 15:41:07 2020 +0100

    vfs_acl_tdb: avoid deleting the NT ACL from the tdb
    
    ...when called as part of setting a new NT ACL. This implements the same logic
    added to vfs_acl_xattr in the previous commit, to make sure both modules behave
    identically.
    
    This depends on the previous code changes, so
    won't be back ported. But for reference the
    bug id is below.
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14592
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>
    
    Autobuild-User(master): Jeremy Allison <jra at samba.org>
    Autobuild-Date(master): Thu Dec 17 20:04:22 UTC 2020 on sn-devel-184

commit 25ec288172738f78a7f97e241de2684fd97ad51e
Author: Ralph Boehme <slow at samba.org>
Date:   Wed Dec 16 15:42:46 2020 +0100

    vfs_acl_xattr: avoid removing the ACL xattr
    
    ...when called as part of setting a new NT ACL.
    
    This depends on the previous code changes, so
    won't be back ported. But for reference the
    bug id is below.
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14592
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit e6b0797caff1e292cec3bee245ee63e58702efb8
Author: Ralph Boehme <slow at samba.org>
Date:   Wed Dec 16 15:37:02 2020 +0100

    vfs_acl_common: add an fsp extension when setting ACL
    
    This allows the module checking for the fsp extension variable setting_nt_acl
    and will be used in the module functions for .sys_acl_set_fd_fn (so
    sys_acl_set_fd_xattr() and sys_acl_set_fd_tdb()).
    
    This depends on the previous code changes, so
    won't be back ported. But for reference the
    bug id is below.
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14592
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 498831cf66b77cad77cceebce0bfd9b00dd5c572
Author: Ralph Boehme <slow at samba.org>
Date:   Wed Dec 16 15:32:52 2020 +0100

    vfs_acl_common: add and use a function exit label
    
    No change in behaviour. A subsequent commit will add more function exit cleanup
    logic after the done label.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit d860785f68c20e4460d9386c48494ada10bad77e
Author: Ralph Boehme <slow at samba.org>
Date:   Sat Dec 12 14:16:54 2020 +0100

    vfs_acl_xattr: reformatting
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 92b149954237a445594c993b79a860c63113d54b
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Dec 14 16:23:38 2020 +0100

    vfs: RIP SMB_VFS_SYS_ACL_SET_FILE()
    
              .--. .-,       .-..-.__
            .'(`.-` \_.-'-./`  |\_( "\__
         __.>\ ';  _;---,._|   / __/`'--)
        /.--.  : |/' _.--.<|  /  | |
    _..-'    `\     /' /`  /_/ _/_/
     >_.-``-. `Y  /' _;---.`|/))))
    '` .-''. \|:  .'   __, .-'"`
     .'--._ `-:  \/:  /'  '.\             _|_
         /.'`\ :;   /'      `-           `-|-`
        -`    |     |                      |
              :.; : |                  .-'~^~`-.
              |:    |                .' _     _ `.
              |:.   |                | |_) | |_) |
              :. :  |                | | \ | |   |
              : ;   |                |           |
              : ;   |                |  SMB_VFS  |
              : ;   |                |  SYS_ACL  |
              : ;   |                | SET_FILE  |
            .jgs. : ;                |           |
    -."-/\\\/:::.    `\."-._'."-"_\\-|           |///."-
    " -."-.\\"-."//.-".`-."_\\-.".-\\`=.........=`//-".
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 6efe41c49cbcf3d6de95f33983f59aecd6a1ee31
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Dec 14 11:21:05 2020 +0100

    posix_acls: use pathref fsp in copy_access_posix_acl()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 24a46b9db9561c49996a2e77320228a7d22de08a
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Dec 14 11:20:46 2020 +0100

    smbd: use pathref fsp in change_dir_owner_to_parent()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 74b9080668cd4307e14049c9d908b5610911507b
Author: Ralph Boehme <slow at samba.org>
Date:   Wed Dec 16 15:27:39 2020 +0100

    smbd: use a real dirfsp/atname in mkdir_internal() with SMB_VFS_MKDIRAT()
    
    Now that all VFS modules support real dirfsps in SMB_VFS_MKDIRAT(), pass the
    pathref fsp from the parent directory and the basename of the new directory.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 43b5e97ad9620dcb5d79cdcf0fa6d6e61ebc5106
Author: Ralph Boehme <slow at samba.org>
Date:   Wed Dec 16 15:25:47 2020 +0100

    smbd: after creating a directory, open the fsp as pathref fsp
    
    After the directory has been created by SMB_VFS_MKDIRAT(), open the fsp on the
    new directory as pathref fsp so we can use handle based VFS functions.
    
    open_directory() will reopen the fsp as a full fsp, but that doesn't really hurt
    thanks to the reopen_from_procfd() optimisation.
    
    Note that smb_dname == fsp->fsp_name.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 83ffeac71636fa397c52116cbf8839ec350e2f51
Author: Ralph Boehme <slow at samba.org>
Date:   Thu Dec 17 12:31:13 2020 +0100

    smbd: pass fsp to mkdir_internal()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 405d11642b6dcfb373827f05cd2eef33c91e00db
Author: Ralph Boehme <slow at samba.org>
Date:   Wed Dec 16 15:20:47 2020 +0100

    smbd: open a pathref fsp on the parent directory
    
    Prepares for calling SMB_VFS_MKDIRAT() below with a real dirfsp/atname. As
    parent_dir_fname now has a pathref fsp in parent_dir_fname->fsp, make sure to
    talloc_free() the parent_dir_fname before leaving the function, so the pathref
    fsp is closed right there and not left around until the talloc tos is
    destroyed (parent_dir_fname is a child of talloc-tos).
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 621793733dc6f22b2c90ca236906c62127e93cb0
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Dec 14 15:56:11 2020 +0100

    vfs_time_audit: support real dirfsps in smb_time_audit_mkdirat()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit cf07a5cd456c371dd0ff1b893cc6394299bd6920
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Dec 14 15:55:04 2020 +0100

    vfs_full_audit: support real dirfsps in smb_full_audit_mkdirat()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit a6f35e89d004405f80d0d8d8f7d0e6a67e14cd3d
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Dec 14 15:53:33 2020 +0100

    vfs_shadow_copy2: support real dirfsps in shadow_copy2_mkdirat()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit c3fb27d92b82241183ae811e5ee7ca90e53b7284
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Dec 14 15:53:11 2020 +0100

    smbd: check for absolute paths in full_path_from_dirfsp_atname()
    
    If the "atname" is an absolute path we can ignore the dirfsp and just return a
    copy of the atname.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 71a614861a50a7b8cfb568eca092f86b982274f9
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Dec 14 15:49:15 2020 +0100

    vfs_linux_xfs_sgid: support real dirfsps in linux_xfs_sgid_mkdirat()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 640629b21ba95148e81c5473f0bfb8ab45a27752
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Dec 14 15:43:39 2020 +0100

    vfs_glusterfs: support real dirfsps in vfs_gluster_mkdirat()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit cb3d8b20def699377e48fb32cfed32bf7c716373
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Dec 14 15:42:23 2020 +0100

    vfs_audit: support real dirfsps in audit_mkdirat()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 6c79c2f2e829f5a11687785f5761675f25d93f7f
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Dec 14 15:39:37 2020 +0100

    vfs_extd_audit: support real dirfsps in audit_mkdirat()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit dc4c952807fd80993c6aaa9b1cd5a2918c5b0618
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Dec 14 15:38:07 2020 +0100

    vfs_xattr_tdb: support real dirfsps in xattr_tdb_mkdirat()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 875fd6eec256c195f7bbb56fc1dd7e22cdfeff04
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Dec 14 15:35:22 2020 +0100

    vfs_media_harmony: support real dirfsps in mh_mkdirat()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 2d57908f139b0a13a2f70906ab4dcdb220d80284
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Dec 14 15:31:37 2020 +0100

    vfs_syncops: support real dirfsps in syncops_mkdirat()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 9bafb8940331fed0432f3e93aee346f3ea4c62df
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Dec 14 15:29:10 2020 +0100

    vfs_unityed_media: support real dirfsps in um_mkdirat()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 3dee234e25eaf04bbf1afff316226da3090f1e82
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Dec 14 11:55:10 2020 +0100

    vfs_default: remove assert from vfswrap_mkdirat()
    
    vfswrap_mkdirat() deals with real dirfsps just fine now.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit b54158fb72d5008c0cf639c9d24501a010885ef1
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Dec 14 11:51:20 2020 +0100

    smbd: move mode logic out of vfswrap_mkdirat() to the caller mkdir_internal()
    
    This is the correct place where this code should be. It also means opaque VFS
    modules that implement their own mkdirat() like glusterfs now use this logic.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 1af5892a9851389b9eba978c4c70cc67392dce0e
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Dec 14 11:25:12 2020 +0100

    pysmbd: use SMB_VFS_SYS_ACL_SET_FD() in set_sys_acl_conn()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 33cbe40c4190f90039bb59a23ea0316b5ed8c507
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Dec 14 11:21:45 2020 +0100

    posix_acls: use SMB_VFS_SYS_ACL_SET_FD() in set_unix_posix_default_acl()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 8d323aebe34f4d6188e98c7a9551b140d9ee1121
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Dec 14 10:44:47 2020 +0100

    posix_acls: use SMB_VFS_SYS_ACL_SET_FD() in set_canon_ace_list()
    
    SMB_VFS_SYS_ACL_SET_FD() can now safely be used to set default ACLs on
    directories.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 1f4426b44e178d05337b7804987a74c4628a2530
Author: Ralph Boehme <slow at samba.org>
Date:   Sun Dec 13 09:11:37 2020 +0100

    vfs_default: add support for SMB_ACL_TYPE_DEFAULT and pathref fsps in vfswrap_sys_acl_set_fd()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit ee0a6d228abf6d3f49c2c0f10de4eb705f914731
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Dec 14 10:07:04 2020 +0100

    vfs_aixacl2: handle pathref fsps in aixjfs2_sys_acl_set_fd()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit f4c2f867f035fcbe3d547d5635d058b0aec7636a
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Dec 14 10:04:15 2020 +0100

    vfs_aixacl: handle pathref fsps in aixacl_sys_acl_set_fd()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit fc6ee68c2908c8cae8fe02809028e92d3092791d
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Dec 14 08:10:44 2020 +0100

    vfs_vxfs: add support for SMB_ACL_TYPE_DEFAULT in vxfs_sys_acl_set_fd()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 9303683ee284feaed846b6e6e9fdc615922b7a74
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Dec 14 08:08:30 2020 +0100

    vfs_tru64acl: add support for SMB_ACL_TYPE_DEFAULT to tru64acl_sys_acl_set_fd()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 7d9a9993cc70c7130990b3a2b471f081af30528a
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Dec 14 08:05:53 2020 +0100

    vfs_solarisacl: add support for SMB_ACL_TYPE_DEFAULT in solarisacl_sys_acl_set_fd()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit bf369327dbfd301da6b49d73f25f2ef6e088524a
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Dec 14 07:57:45 2020 +0100

    vfs_posixacl: support SMB_ACL_TYPE_DEFAULT in posixacl_sys_acl_set_fd()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit ba07df5e0d9d43ba74b93e9b05156b0c1a2f83a9
Author: Ralph Boehme <slow at samba.org>
Date:   Sun Dec 13 09:19:25 2020 +0100

    vfs_gpfs: add support for SMB_ACL_TYPE_DEFAULT in gpfsacl_sys_acl_set_fd()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit a866027e41bbf8f73868061dc17d88ad8da78a41
Author: Ralph Boehme <slow at samba.org>
Date:   Sun Dec 13 09:18:00 2020 +0100

    vfs_fake_acls: add support for SMB_ACL_TYPE_DEFAULT in fake_acls_sys_acl_set_fd()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 6c30d49f4800ea67df651190d7458bbb724a5d5e
Author: Ralph Boehme <slow at samba.org>
Date:   Sun Dec 13 09:07:51 2020 +0100

    vfs_aixacl2: use ACL type in aixjfs2_sys_acl_set_fd()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 3363cddc3a754ff52a8acbdc164bec6bed112583
Author: Ralph Boehme <slow at samba.org>
Date:   Sun Dec 13 09:06:24 2020 +0100

    vfs_aixacl: use passed in ACL type in aixacl_sys_acl_set_fd()
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 467dbdbdde30a8214200bf2be7674bbcb07460f8
Author: Ralph Boehme <slow at samba.org>
Date:   Sun Dec 13 08:55:39 2020 +0100

    posixacl_xattr: add support for SMB_ACL_TYPE_DEFAULT in posixacl_xattr_acl_set_fd()
    
    No need to handle pathref fsps here, as that is taken care of by
    SMB_VFS_FSETXATTR().
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 8d0ea8bafa003984dda4a105e4c8b755644cc7f7
Author: Ralph Boehme <slow at samba.org>
Date:   Mon Dec 14 16:28:26 2020 +0100

    vfs: add acl type arg to SMB_VFS_SYS_ACL_SET_FD()
    
    No change in behaviour, the new arg is not yet used in any module.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit ebf37cfc3cb025171e0ceca321b343de82975c42
Author: Ralph Boehme <slow at samba.org>
Date:   Thu Dec 17 12:41:29 2020 +0100

    smbd: remove fd_close() from open_directory()
    
    fd_close() was accidentally added twice by
    d00d09fdcf73a5839ae4f82cf8e953bb761bfbfb. If it would have been removed by
    5770cdd7635a018817418f58bd37268aedebd6a9 that adds the reopen_from_procfd()
    optimisation, all would be fine. But fd_close() still being called before
    reopen_from_procfd() means we're closing the pathref fd prevening the
    optimisation.
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit de806498603b47274f1e4647eeb2a84db2b7319a
Author: Jeremy Allison <jra at samba.org>
Date:   Wed Dec 16 16:38:28 2020 -0800

    smbd: Ensure close_directory() and close_normal_file() only deal with is_fsa files.
    
    This must be the case, so assert it.
    
    Signed-off-by: Jeremy Allison <jra at samba.org>
    Reviewed-by: Ralph Boehme <slow at samba.org>

commit 7c5476baadb44b34566341ef3cfc9bb32ca81c68
Author: Ralph Boehme <slow at samba.org>
Date:   Thu Dec 17 13:41:20 2020 +0100

    smbd: mark fsp as valid FSA fsp after Durable Handle reconnect succeeded
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 59b0fae26e1f7c1d340be4b67bbca13ff8bba43f
Author: Jeremy Allison <jra at samba.org>
Date:   Wed Dec 16 19:49:56 2020 -0800

    smbd: Move closing a print file out of close_normal_file() (it isn't a normal file) and into close_file().
    
    Streamlines closing print files and allows close_normal_file()
    to restrict itself to is_fsa fsps.
    
    Signed-off-by: Jeremy Allison <jra at samba.org>
    Reviewed-by: Ralph Boehme <slow at samba.org>

commit 12dd02d884df84b9e6ea14e67c13a86482cf9cc5
Author: Jeremy Allison <jra at samba.org>
Date:   Wed Dec 16 15:44:41 2020 -0800

    smbd: On error exit in create_file_unixpath(), we can't call close_file() on uncompleted opens.
    
    We can't call directly into close_file(), as that cannot deal
    with regular file and directory opens where fsp->fsp_flags.is_fsa
    hasn't been set to true (uncompleted opens).
    
    Signed-off-by: Jeremy Allison <jra at samba.org>
    Reviewed-by: Ralph Boehme <slow at samba.org>

commit e7f1588ee490249204fd730663d2161d6a5fa6e0
Author: Jeremy Allison <jra at samba.org>
Date:   Wed Dec 16 23:59:50 2020 -0800

    smbd: If an smb_filename already has a pathref fsp don't overwrite it.
    
    That leaks fsps.
    
    Signed-off-by: Jeremy Allison <jra at samba.org>
    Reviewed-by: Ralph Boehme <slow at samba.org>

commit 8559af63169730e008e838aebfdd63b135a9caf7
Author: Jeremy Allison <jra at samba.org>
Date:   Thu Dec 17 01:10:12 2020 -0800

    smbd: dup_file_fsp() for old DOS style opens also needs to copy the new flags.
    
    Signed-off-by: Jeremy Allison <jra at samba.org>
    Reviewed-by: Ralph Boehme <slow at samba.org>

commit cbe1485f7b27a598588d42cf1430e74a90ef3e69
Author: Jeremy Allison <jra at samba.org>
Date:   Wed Dec 16 23:55:31 2020 -0800

    smbd: Fix debugs in file_new() and fsp_new().
    
    Allows grep ' files structure ' in the log
    to count up and down the number of files allocated.
    
    Signed-off-by: Jeremy Allison <jra at samba.org>
    Reviewed-by: Ralph Boehme <slow at samba.org>

-----------------------------------------------------------------------

Summary of changes:
 docs-xml/manpages/vfs_full_audit.8.xml |   1 -
 examples/VFS/skel_opaque.c             |  14 +--
 examples/VFS/skel_transparent.c        |  16 +---
 source3/include/vfs.h                  |  27 +++---
 source3/include/vfs_macros.h           |  13 +--
 source3/lib/sysacls.c                  |   2 +-
 source3/modules/posixacl_xattr.c       |  16 +++-
 source3/modules/posixacl_xattr.h       |   1 +
 source3/modules/vfs_acl_common.c       |  34 +++----
 source3/modules/vfs_acl_common.h       |   4 +
 source3/modules/vfs_acl_tdb.c          |  58 ++----------
 source3/modules/vfs_acl_xattr.c        |  42 +++------
 source3/modules/vfs_aixacl.c           |  34 +++----
 source3/modules/vfs_aixacl2.c          |  56 +++--------
 source3/modules/vfs_audit.c            |  12 ++-
 source3/modules/vfs_cap.c              |  39 --------
 source3/modules/vfs_catia.c            |  50 +---------
 source3/modules/vfs_ceph.c             |  15 ---
 source3/modules/vfs_default.c          |  63 ++++++++-----
 source3/modules/vfs_extd_audit.c       |  14 ++-
 source3/modules/vfs_fake_acls.c        |  22 ++++-
 source3/modules/vfs_full_audit.c       |  43 ++++-----
 source3/modules/vfs_glusterfs.c        |  16 +++-
 source3/modules/vfs_gpfs.c             |  40 +++-----
 source3/modules/vfs_hpuxacl.c          |   1 -
 source3/modules/vfs_linux_xfs_sgid.c   |  16 ++--
 source3/modules/vfs_media_harmony.c    |  50 +++-------
 source3/modules/vfs_nfs4acl_xattr.c    |  10 +-
 source3/modules/vfs_not_implemented.c  |  14 +--
 source3/modules/vfs_posixacl.c         |   8 +-
 source3/modules/vfs_posixacl.h         |   1 +
 source3/modules/vfs_shadow_copy2.c     |  12 ++-
 source3/modules/vfs_solarisacl.c       | 118 +++--------------------
 source3/modules/vfs_streams_xattr.c    |   3 +-
 source3/modules/vfs_syncops.c          |  14 ++-
 source3/modules/vfs_time_audit.c       |  40 +++-----
 source3/modules/vfs_tru64acl.c         |  46 ++-------
 source3/modules/vfs_unityed_media.c    |  52 +++-------
 source3/modules/vfs_vxfs.c             |  23 +----
 source3/modules/vfs_xattr_tdb.c        |  16 ++--
 source3/modules/vfs_zfsacl.c           |  10 +-
 source3/smbd/close.c                   |  16 ++--
 source3/smbd/durable.c                 |   2 +
 source3/smbd/filename.c                |   3 +-
 source3/smbd/files.c                   |  17 +++-
 source3/smbd/open.c                    | 167 ++++++++++++++-------------------
 source3/smbd/posix_acls.c              | 106 ++++++---------------
 source3/smbd/pysmbd.c                  |  11 ++-
 source3/smbd/vfs.c                     |  16 +---
 49 files changed, 485 insertions(+), 919 deletions(-)


Changeset truncated at 500 lines:

diff --git a/docs-xml/manpages/vfs_full_audit.8.xml b/docs-xml/manpages/vfs_full_audit.8.xml
index d4fbdb4f02e..1b768917d21 100644
--- a/docs-xml/manpages/vfs_full_audit.8.xml
+++ b/docs-xml/manpages/vfs_full_audit.8.xml
@@ -145,7 +145,6 @@
         <member>sys_acl_get_fd</member>
         <member>sys_acl_get_file</member>
         <member>sys_acl_set_fd</member>
-        <member>sys_acl_set_file</member>
         <member>telldir</member>
         <member>translate_name</member>
         <member>unlinkat</member>
diff --git a/examples/VFS/skel_opaque.c b/examples/VFS/skel_opaque.c
index 881a7fdaf1c..1f20753fc76 100644
--- a/examples/VFS/skel_opaque.c
+++ b/examples/VFS/skel_opaque.c
@@ -839,16 +839,9 @@ static int skel_sys_acl_blob_get_fd(vfs_handle_struct *handle,
 	return -1;
 }
 
-static int skel_sys_acl_set_file(vfs_handle_struct *handle,
-				const struct smb_filename *smb_fname,
-				SMB_ACL_TYPE_T acltype,
-				SMB_ACL_T theacl)
-{
-	errno = ENOSYS;
-	return -1;
-}
-
-static int skel_sys_acl_set_fd(vfs_handle_struct *handle, files_struct *fsp,
+static int skel_sys_acl_set_fd(vfs_handle_struct *handle,
+			       struct files_struct *fsp,
+			       SMB_ACL_TYPE_T type,
 			       SMB_ACL_T theacl)
 {
 	errno = ENOSYS;
@@ -1138,7 +1131,6 @@ static struct vfs_fn_pointers skel_opaque_fns = {
 	.sys_acl_get_fd_fn = skel_sys_acl_get_fd,
 	.sys_acl_blob_get_file_fn = skel_sys_acl_blob_get_file,
 	.sys_acl_blob_get_fd_fn = skel_sys_acl_blob_get_fd,
-	.sys_acl_set_file_fn = skel_sys_acl_set_file,
 	.sys_acl_set_fd_fn = skel_sys_acl_set_fd,
 	.sys_acl_delete_def_file_fn = skel_sys_acl_delete_def_file,
 
diff --git a/examples/VFS/skel_transparent.c b/examples/VFS/skel_transparent.c
index 2680b4f3285..f7d99e6101b 100644
--- a/examples/VFS/skel_transparent.c
+++ b/examples/VFS/skel_transparent.c
@@ -1103,19 +1103,12 @@ static int skel_sys_acl_blob_get_fd(vfs_handle_struct *handle,
 						blob_description, blob);
 }
 
-static int skel_sys_acl_set_file(vfs_handle_struct *handle,
-				const struct smb_filename *smb_fname,
-				SMB_ACL_TYPE_T acltype,
-				SMB_ACL_T theacl)
-{
-	return SMB_VFS_NEXT_SYS_ACL_SET_FILE(handle, smb_fname,
-			acltype, theacl);
-}
-
-static int skel_sys_acl_set_fd(vfs_handle_struct *handle, files_struct *fsp,
+static int skel_sys_acl_set_fd(vfs_handle_struct *handle,
+			       struct files_struct *fsp,
+			       SMB_ACL_TYPE_T type,
 			       SMB_ACL_T theacl)
 {
-	return SMB_VFS_NEXT_SYS_ACL_SET_FD(handle, fsp, theacl);
+	return SMB_VFS_NEXT_SYS_ACL_SET_FD(handle, fsp, type, theacl);
 }
 
 static int skel_sys_acl_delete_def_file(vfs_handle_struct *handle,
@@ -1443,7 +1436,6 @@ static struct vfs_fn_pointers skel_transparent_fns = {
 	.sys_acl_get_fd_fn = skel_sys_acl_get_fd,
 	.sys_acl_blob_get_file_fn = skel_sys_acl_blob_get_file,
 	.sys_acl_blob_get_fd_fn = skel_sys_acl_blob_get_fd,
-	.sys_acl_set_file_fn = skel_sys_acl_set_file,
 	.sys_acl_set_fd_fn = skel_sys_acl_set_fd,
 	.sys_acl_delete_def_file_fn = skel_sys_acl_delete_def_file,
 
diff --git a/source3/include/vfs.h b/source3/include/vfs.h
index 1a5d71e8401..04c8c3e4c76 100644
--- a/source3/include/vfs.h
+++ b/source3/include/vfs.h
@@ -340,6 +340,8 @@
  * Version 44 - Add dirfsp arg to SMB_VFS_READDIR()
  * Version 44 - Remove SMB_VFS_GET_DOS_ATTRIBUTES()
  * Version 44 - Replace SMB_VFS_GET_COMPRESSION() with SMB_VFS_FGET_COMPRESSION()
+ * Version 44 - Add type argument to SMB_VFS_SYS_ACL_SET_FD()
+ * Version 44 - Remove SMB_VFS_SYS_ACL_SET_FILE()
  */
 
 #define SMB_VFS_INTERFACE_VERSION 44
@@ -1215,11 +1217,10 @@ struct vfs_fn_pointers {
 	int (*sys_acl_blob_get_fd_fn)(struct vfs_handle_struct *handle, struct files_struct *fsp,
 				      TALLOC_CTX *mem_ctx, char **blob_description,
 				      DATA_BLOB *blob);
-	int (*sys_acl_set_file_fn)(struct vfs_handle_struct *handle,
-					const struct smb_filename *smb_fname,
-					SMB_ACL_TYPE_T acltype,
-					SMB_ACL_T theacl);
-	int (*sys_acl_set_fd_fn)(struct vfs_handle_struct *handle, struct files_struct *fsp, SMB_ACL_T theacl);
+	int (*sys_acl_set_fd_fn)(struct vfs_handle_struct *handle,
+				 struct files_struct *fsp,
+				 SMB_ACL_TYPE_T type,
+				 SMB_ACL_T theacl);
 	int (*sys_acl_delete_def_file_fn)(struct vfs_handle_struct *handle,
 					const struct smb_filename *smb_fname);
 
@@ -1741,12 +1742,10 @@ int smb_vfs_call_sys_acl_blob_get_fd(struct vfs_handle_struct *handle,
 				     TALLOC_CTX *mem_ctx,
 				     char **blob_description,
 				     DATA_BLOB *blob);
-int smb_vfs_call_sys_acl_set_file(struct vfs_handle_struct *handle,
-				const struct smb_filename *smb_fname,
-				SMB_ACL_TYPE_T acltype,
-				SMB_ACL_T theacl);
 int smb_vfs_call_sys_acl_set_fd(struct vfs_handle_struct *handle,
-				struct files_struct *fsp, SMB_ACL_T theacl);
+				struct files_struct *fsp,
+				SMB_ACL_TYPE_T type,
+				SMB_ACL_T theacl);
 int smb_vfs_call_sys_acl_delete_def_file(struct vfs_handle_struct *handle,
 				const struct smb_filename *smb_fname);
 ssize_t smb_vfs_call_getxattr(struct vfs_handle_struct *handle,
@@ -2160,11 +2159,9 @@ int vfs_not_implemented_sys_acl_blob_get_file(vfs_handle_struct *handle,
 int vfs_not_implemented_sys_acl_blob_get_fd(vfs_handle_struct *handle,
 				files_struct *fsp, TALLOC_CTX *mem_ctx,
 				char **blob_description, DATA_BLOB *blob);
-int vfs_not_implemented_sys_acl_set_file(vfs_handle_struct *handle,
-				const struct smb_filename *smb_fname,
-				SMB_ACL_TYPE_T acltype,
-				SMB_ACL_T theacl);
-int vfs_not_implemented_sys_acl_set_fd(vfs_handle_struct *handle, files_struct *fsp,
+int vfs_not_implemented_sys_acl_set_fd(vfs_handle_struct *handle,
+				       struct files_struct *fsp,
+				       SMB_ACL_TYPE_T type,
 				       SMB_ACL_T theacl);
 int vfs_not_implemented_sys_acl_delete_def_file(vfs_handle_struct *handle,
 					const struct smb_filename *smb_fname);
diff --git a/source3/include/vfs_macros.h b/source3/include/vfs_macros.h
index 80720ad16cd..9a6dd67288c 100644
--- a/source3/include/vfs_macros.h
+++ b/source3/include/vfs_macros.h
@@ -508,15 +508,10 @@
 #define SMB_VFS_NEXT_SYS_ACL_BLOB_GET_FD(handle, fsp, mem_ctx, blob_description, blob)	\
 	smb_vfs_call_sys_acl_blob_get_fd((handle)->next, (fsp), mem_ctx, (blob_description), (blob))
 
-#define SMB_VFS_SYS_ACL_SET_FILE(conn, smb_fname, acltype, theacl) \
-	smb_vfs_call_sys_acl_set_file((conn)->vfs_handles, (smb_fname), (acltype), (theacl))
-#define SMB_VFS_NEXT_SYS_ACL_SET_FILE(handle, smb_fname, acltype, theacl) \
-	smb_vfs_call_sys_acl_set_file((handle)->next, (smb_fname), (acltype), (theacl))
-
-#define SMB_VFS_SYS_ACL_SET_FD(fsp, theacl) \
-	smb_vfs_call_sys_acl_set_fd((fsp)->conn->vfs_handles, (fsp), (theacl))
-#define SMB_VFS_NEXT_SYS_ACL_SET_FD(handle, fsp, theacl) \
-	smb_vfs_call_sys_acl_set_fd((handle)->next, (fsp), (theacl))
+#define SMB_VFS_SYS_ACL_SET_FD(fsp, type, theacl) \
+	smb_vfs_call_sys_acl_set_fd((fsp)->conn->vfs_handles, (fsp), (type), (theacl))
+#define SMB_VFS_NEXT_SYS_ACL_SET_FD(handle, fsp, type, theacl) \
+	smb_vfs_call_sys_acl_set_fd((handle)->next, (fsp), (type), (theacl))
 
 #define SMB_VFS_SYS_ACL_DELETE_DEF_FILE(conn, smb_fname) \
 	smb_vfs_call_sys_acl_delete_def_file((conn)->vfs_handles, (smb_fname))
diff --git a/source3/lib/sysacls.c b/source3/lib/sysacls.c
index c80f8f30c90..ad970b6299b 100644
--- a/source3/lib/sysacls.c
+++ b/source3/lib/sysacls.c
@@ -387,7 +387,7 @@ int sys_acl_set_file(vfs_handle_struct *handle,
 int sys_acl_set_fd(vfs_handle_struct *handle, files_struct *fsp,
 		   SMB_ACL_T acl_d)
 {
-	return posixacl_sys_acl_set_fd(handle, fsp, acl_d);
+	return posixacl_sys_acl_set_fd(handle, fsp, SMB_ACL_TYPE_ACCESS, acl_d);
 }
 
 int sys_acl_delete_def_file(vfs_handle_struct *handle,
diff --git a/source3/modules/posixacl_xattr.c b/source3/modules/posixacl_xattr.c
index 6f016e17e0b..7582ceb121e 100644
--- a/source3/modules/posixacl_xattr.c
+++ b/source3/modules/posixacl_xattr.c
@@ -479,12 +479,24 @@ int posixacl_xattr_acl_set_file(vfs_handle_struct *handle,
 }
 
 int posixacl_xattr_acl_set_fd(vfs_handle_struct *handle,
-			      files_struct *fsp, SMB_ACL_T theacl)
+			      files_struct *fsp,
+			      SMB_ACL_TYPE_T type,
+			      SMB_ACL_T theacl)
 {
+	const char *name = NULL;
 	char *buf;
 	ssize_t size;
 	int ret;
 
+	if (type == SMB_ACL_TYPE_ACCESS) {
+		name = ACL_EA_ACCESS;
+	} else if (type == SMB_ACL_TYPE_DEFAULT) {
+		name = ACL_EA_DEFAULT;
+	} else {
+		errno = EINVAL;
+		return -1;
+	}
+
 	size = smb_acl_to_posixacl_xattr(theacl, NULL, 0);
 	buf = alloca(size);
 	if (!buf) {
@@ -497,7 +509,7 @@ int posixacl_xattr_acl_set_fd(vfs_handle_struct *handle,
 		return -1;
 	}
 
-	return SMB_VFS_FSETXATTR(fsp, ACL_EA_ACCESS, buf, size, 0);
+	return SMB_VFS_FSETXATTR(fsp, name, buf, size, 0);
 }
 
 int posixacl_xattr_acl_delete_def_file(vfs_handle_struct *handle,
diff --git a/source3/modules/posixacl_xattr.h b/source3/modules/posixacl_xattr.h
index 70962dd3115..7d0fb2bb8bf 100644
--- a/source3/modules/posixacl_xattr.h
+++ b/source3/modules/posixacl_xattr.h
@@ -37,6 +37,7 @@ int posixacl_xattr_acl_set_file(vfs_handle_struct *handle,
 
 int posixacl_xattr_acl_set_fd(vfs_handle_struct *handle,
 			      files_struct *fsp,
+			      SMB_ACL_TYPE_T type,
 			      SMB_ACL_T theacl);
 
 int posixacl_xattr_acl_delete_def_file(vfs_handle_struct *handle,
diff --git a/source3/modules/vfs_acl_common.c b/source3/modules/vfs_acl_common.c
index 14ea915d828..5aeb159b686 100644
--- a/source3/modules/vfs_acl_common.c
+++ b/source3/modules/vfs_acl_common.c
@@ -1034,6 +1034,7 @@ NTSTATUS fset_nt_acl_common(
 	TALLOC_CTX *frame = talloc_stackframe();
 	bool ignore_file_system_acl = lp_parm_bool(
 	    SNUM(handle->conn), module_name, "ignore system acls", false);
+	struct acl_common_fsp_ext *ext = NULL;
 
 	if (DEBUGLEVEL >= 10) {
 		DBG_DEBUG("incoming sd for file %s\n", fsp_str_dbg(fsp));
@@ -1090,6 +1091,12 @@ NTSTATUS fset_nt_acl_common(
 		psd->type |= SEC_DESC_SACL_PRESENT;
 	}
 
+	ext = VFS_ADD_FSP_EXTENSION(handle,
+				    fsp,
+				    struct acl_common_fsp_ext,
+				    NULL);
+	ext->setting_nt_acl = true;
+
 	if (ignore_file_system_acl) {
 		if (chown_needed) {
 			/* send only ownership stuff to lower layer */
@@ -1097,23 +1104,19 @@ NTSTATUS fset_nt_acl_common(
 			status = set_underlying_acl(handle, fsp, psd,
 						    security_info_sent, true);
 			if (!NT_STATUS_IS_OK(status)) {
-				TALLOC_FREE(frame);
-				return status;
+				goto done;
 			}
 		}
 		ZERO_ARRAY(hash);
 		status = store_v3_blob(store_acl_blob_fsp_fn, handle, fsp, psd,
 				       NULL, hash);
-
-		TALLOC_FREE(frame);
-		return status;
+		goto done;
 	}
 
 	status = set_underlying_acl(handle, fsp, psd, security_info_sent,
 				    chown_needed);
 	if (!NT_STATUS_IS_OK(status)) {
-		TALLOC_FREE(frame);
-		return status;
+		goto done;
 	}
 
 	/* Get the full underlying sd, then hash. */
@@ -1124,14 +1127,12 @@ NTSTATUS fset_nt_acl_common(
 					  &pdesc_next);
 
 	if (!NT_STATUS_IS_OK(status)) {
-		TALLOC_FREE(frame);
-		return status;
+		goto done;
 	}
 
 	status = hash_sd_sha256(pdesc_next, hash);
 	if (!NT_STATUS_IS_OK(status)) {
-		TALLOC_FREE(frame);
-		return status;
+		goto done;
 	}
 
 	/* Get the full underlying sd, then hash. */
@@ -1147,14 +1148,12 @@ NTSTATUS fset_nt_acl_common(
 		status = store_v3_blob(store_acl_blob_fsp_fn, handle, fsp, psd,
 				       pdesc_next, hash);
 
-		TALLOC_FREE(frame);
-		return status;
+		goto done;
 	}
 
 	status = hash_blob_sha256(sys_acl_blob, sys_acl_hash);
 	if (!NT_STATUS_IS_OK(status)) {
-		TALLOC_FREE(frame);
-		return status;
+		goto done;
 	}
 
 	if (DEBUGLEVEL >= 10) {
@@ -1176,12 +1175,13 @@ NTSTATUS fset_nt_acl_common(
 				     sys_acl_description, sys_acl_hash);
 	if (!NT_STATUS_IS_OK(status)) {
 		DBG_DEBUG("create_sys_acl_blob failed\n");
-		TALLOC_FREE(frame);
-		return status;
+		goto done;
 	}
 
 	status = store_acl_blob_fsp_fn(handle, fsp, &blob);
 
+done:
+	VFS_REMOVE_FSP_EXTENSION(handle, fsp);
 	TALLOC_FREE(frame);
 	return status;
 }
diff --git a/source3/modules/vfs_acl_common.h b/source3/modules/vfs_acl_common.h
index c84448b9f15..c686395bdfa 100644
--- a/source3/modules/vfs_acl_common.h
+++ b/source3/modules/vfs_acl_common.h
@@ -29,6 +29,10 @@ struct acl_common_config {
 	enum default_acl_style default_acl_style;
 };
 
+struct acl_common_fsp_ext {
+	bool setting_nt_acl;
+};
+
 bool init_acl_common_config(vfs_handle_struct *handle,
 			    const char *module_name);
 
diff --git a/source3/modules/vfs_acl_tdb.c b/source3/modules/vfs_acl_tdb.c
index 2fb03c03efc..4439a92557e 100644
--- a/source3/modules/vfs_acl_tdb.c
+++ b/source3/modules/vfs_acl_tdb.c
@@ -369,55 +369,13 @@ static int connect_acl_tdb(struct vfs_handle_struct *handle,
  Remove a Windows ACL - we're setting the underlying POSIX ACL.
 *********************************************************************/
 
-static int sys_acl_set_file_tdb(vfs_handle_struct *handle,
-			const struct smb_filename *smb_fname_in,
-			SMB_ACL_TYPE_T type,
-			SMB_ACL_T theacl)
-{
-	struct db_context *db = acl_db;
-	int ret = -1;
-	int saved_errno = 0;
-	struct smb_filename *smb_fname = NULL;
-
-	smb_fname = cp_smb_filename_nostream(talloc_tos(), smb_fname_in);
-	if (smb_fname == NULL) {
-		return -1;
-	};
-
-	ret = SMB_VFS_STAT(handle->conn, smb_fname);
-	if (ret == -1) {
-		saved_errno = errno;
-		goto fail;
-	}
-
-	ret = SMB_VFS_NEXT_SYS_ACL_SET_FILE(handle,
-						smb_fname,
-						type,
-						theacl);
-	if (ret == -1) {
-		saved_errno = errno;
-		goto fail;
-	}
-
-	acl_tdb_delete(handle, db, &smb_fname->st);
-
-fail:
-	TALLOC_FREE(smb_fname);
-
-	if (saved_errno != 0) {
-		errno = saved_errno;
-	}
-	return ret;
-}
-
-/*********************************************************************
- Remove a Windows ACL - we're setting the underlying POSIX ACL.
-*********************************************************************/
-
 static int sys_acl_set_fd_tdb(vfs_handle_struct *handle,
                             files_struct *fsp,
+			    SMB_ACL_TYPE_T type,
                             SMB_ACL_T theacl)
 {
+	struct acl_common_fsp_ext *ext = (struct acl_common_fsp_ext *)
+		VFS_FETCH_FSP_EXTENSION(handle, fsp);
 	struct db_context *db = acl_db;
 	NTSTATUS status;
 	int ret;
@@ -428,12 +386,17 @@ static int sys_acl_set_fd_tdb(vfs_handle_struct *handle,
 	}
 
 	ret = SMB_VFS_NEXT_SYS_ACL_SET_FD(handle,
-						fsp,
-						theacl);
+					  fsp,
+					  type,
+					  theacl);
 	if (ret == -1) {
 		return -1;
 	}
 
+	if (ext != NULL && ext->setting_nt_acl) {
+		return 0;
+	}
+
 	acl_tdb_delete(handle, db, &fsp->fsp_name->st);
 	return 0;
 }
@@ -490,7 +453,6 @@ static struct vfs_fn_pointers vfs_acl_tdb_fns = {
 	.fget_nt_acl_fn = acl_tdb_fget_nt_acl,
 	.get_nt_acl_at_fn = acl_tdb_get_nt_acl_at,
 	.fset_nt_acl_fn = acl_tdb_fset_nt_acl,
-	.sys_acl_set_file_fn = sys_acl_set_file_tdb,
 	.sys_acl_set_fd_fn = sys_acl_set_fd_tdb
 };
 
diff --git a/source3/modules/vfs_acl_xattr.c b/source3/modules/vfs_acl_xattr.c
index 2f286ed97f7..f5a26ec5592 100644
--- a/source3/modules/vfs_acl_xattr.c
+++ b/source3/modules/vfs_acl_xattr.c
@@ -223,47 +223,32 @@ static NTSTATUS store_acl_blob_fsp(vfs_handle_struct *handle,
  Remove a Windows ACL - we're setting the underlying POSIX ACL.
 *********************************************************************/
 
-static int sys_acl_set_file_xattr(vfs_handle_struct *handle,
-				const struct smb_filename *smb_fname,
+static int sys_acl_set_fd_xattr(vfs_handle_struct *handle,
+				files_struct *fsp,
 				SMB_ACL_TYPE_T type,
 				SMB_ACL_T theacl)
 {
-	int ret = SMB_VFS_NEXT_SYS_ACL_SET_FILE(handle,
-						smb_fname,
-						type,
-						theacl);
+	struct acl_common_fsp_ext *ext = (struct acl_common_fsp_ext *)
+		VFS_FETCH_FSP_EXTENSION(handle, fsp);
+	int ret;
+
+	ret = SMB_VFS_NEXT_SYS_ACL_SET_FD(handle,
+					  fsp,
+					  type,
+					  theacl);
 	if (ret == -1) {
 		return -1;
 	}
 
-	become_root();
-	SMB_VFS_REMOVEXATTR(handle->conn, smb_fname,
-			XATTR_NTACL_NAME);
-	unbecome_root();
-
-	return ret;
-}
-
-/*********************************************************************
- Remove a Windows ACL - we're setting the underlying POSIX ACL.
-*********************************************************************/
-
-static int sys_acl_set_fd_xattr(vfs_handle_struct *handle,
-                            files_struct *fsp,
-                            SMB_ACL_T theacl)
-{
-	int ret = SMB_VFS_NEXT_SYS_ACL_SET_FD(handle,
-						fsp,
-						theacl);
-	if (ret == -1) {
-		return -1;
+	if (ext != NULL && ext->setting_nt_acl) {
+		return 0;
 	}
 
 	become_root();
 	SMB_VFS_FREMOVEXATTR(fsp, XATTR_NTACL_NAME);
 	unbecome_root();
 
-	return ret;
+	return 0;
 }
 


-- 
Samba Shared Repository


From slow at samba.org  Fri Dec 18 16:28:02 2020
From: slow at samba.org (=?UTF-8?Q?Ralph_B=C3=B6hme?=)
Date: Fri, 18 Dec 2020 16:28:02 +0000
Subject: [SCM] Samba Shared Repository - branch master updated
Message-ID: <E1kqIbq-00A8ur-7P@hrx0.samba.org>

The branch, master has been updated
       via  6b5041c0212 smbd: close_file() should never see an internal dirfsp.
      from  a77de71ced0 vfs_acl_tdb: avoid deleting the NT ACL from the tdb

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 6b5041c0212a16d2f250b75b324e64b4c015462b
Author: Jeremy Allison <jra at samba.org>
Date:   Thu Dec 17 12:31:35 2020 -0800

    smbd: close_file() should never see an internal dirfsp.
    
    Assert this is the case.
    
    Signed-off-by: Jeremy Allison <jra at samba.org>
    Reviewed-by: Ralph Boehme <slow at samba.org>
    
    Autobuild-User(master): Ralph B?hme <slow at samba.org>
    Autobuild-Date(master): Fri Dec 18 16:27:38 UTC 2020 on sn-devel-184

-----------------------------------------------------------------------

Summary of changes:
 source3/smbd/close.c | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)


Changeset truncated at 500 lines:

diff --git a/source3/smbd/close.c b/source3/smbd/close.c
index e53faf98007..20f2ed8a172 100644
--- a/source3/smbd/close.c
+++ b/source3/smbd/close.c
@@ -1291,13 +1291,11 @@ NTSTATUS close_file(struct smb_request *req, files_struct *fsp,
 	NTSTATUS status;
 	struct files_struct *base_fsp = fsp->base_fsp;
 
-	if (fsp->fsp_flags.is_dirfsp) {
-		/*
-		 * The typical way to get here is via file_close_[conn|user]()
-		 * and this is taken care of below.
-		 */
-		return NT_STATUS_OK;
-	}
+	/*
+	 * This fsp can never be an internal dirfsp. They must
+	 * be explicitly closed by TALLOC_FREE of the dir handle.
+	 */
+	SMB_ASSERT(!fsp->fsp_flags.is_dirfsp);
 
 	if (fsp->fsp_flags.is_directory) {
 		status = close_directory(req, fsp, close_type);


-- 
Samba Shared Repository


From jra at samba.org  Sat Dec 19 08:12:01 2020
From: jra at samba.org (Jeremy Allison)
Date: Sat, 19 Dec 2020 08:12:01 +0000
Subject: [SCM] Samba Shared Repository - branch master updated
Message-ID: <E1kqXLN-001nTv-Jl@hrx0.samba.org>

The branch, master has been updated
       via  9b44f7a71ec gpo: Apply Group Policy Sudo Rights from VGP
       via  932af62eade gpo: Test Group Policy VGP Sudo Rights
       via  440802c24a8 gpo: Add gp_xml_ext parser for group policy
      from  6b5041c0212 smbd: close_file() should never see an internal dirfsp.

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 9b44f7a71ec7772fbb47167e0ba4d5c51397cfad
Author: David Mulder <dmulder at suse.com>
Date:   Tue Nov 3 10:45:45 2020 -0700

    gpo: Apply Group Policy Sudo Rights from VGP
    
    This adds a Group Policy extension which applies
    Sudo rights set by Vintela Group Policy in the
    SYSVOL.
    
    Signed-off-by: David Mulder <dmulder at suse.com>
    Reviewed-by: Jeremy Allison <jra at samba.org>
    
    Autobuild-User(master): Jeremy Allison <jra at samba.org>
    Autobuild-Date(master): Sat Dec 19 08:11:50 UTC 2020 on sn-devel-184

commit 932af62eade70714ca7351738b936123c5345fd0
Author: David Mulder <dmulder at suse.com>
Date:   Tue Nov 3 13:14:34 2020 -0700

    gpo: Test Group Policy VGP Sudo Rights
    
    Signed-off-by: David Mulder <dmulder at suse.com>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 440802c24a8f49809b41f14997e406d2795b8e95
Author: David Mulder <dmulder at suse.com>
Date:   Tue Nov 3 10:44:27 2020 -0700

    gpo: Add gp_xml_ext parser for group policy
    
    This adds an extension parser for parsing xml
    files in the sysvol.
    
    Signed-off-by: David Mulder <dmulder at suse.com>
    Reviewed-by: Jeremy Allison <jra at samba.org>

-----------------------------------------------------------------------

Summary of changes:
 python/samba/gpclass.py              |   9 ++++
 python/samba/tests/gpo.py            |  68 +++++++++++++++++++++++
 python/samba/vgp_sudoers_ext.py      | 101 +++++++++++++++++++++++++++++++++++
 source4/scripting/bin/samba-gpupdate |   2 +
 4 files changed, 180 insertions(+)
 create mode 100644 python/samba/vgp_sudoers_ext.py


Changeset truncated at 500 lines:

diff --git a/python/samba/gpclass.py b/python/samba/gpclass.py
index ac73671eb58..1b29711f245 100644
--- a/python/samba/gpclass.py
+++ b/python/samba/gpclass.py
@@ -341,6 +341,15 @@ class gp_pol_ext(gp_ext):
         return ndr_unpack(preg.file, raw)
 
 
+class gp_xml_ext(gp_ext):
+    def read(self, data_file):
+        raw = open(data_file, 'rb').read()
+        try:
+            return etree.fromstring(raw.decode())
+        except UnicodeDecodeError:
+            return etree.fromstring(raw.decode('utf-16'))
+
+
 ''' Fetch the hostname of a writable DC '''
 
 
diff --git a/python/samba/tests/gpo.py b/python/samba/tests/gpo.py
index 115b71ac61d..a0dce8d96d7 100644
--- a/python/samba/tests/gpo.py
+++ b/python/samba/tests/gpo.py
@@ -27,6 +27,7 @@ from tempfile import NamedTemporaryFile, TemporaryDirectory
 from samba.gp_sec_ext import gp_krb_ext, gp_access_ext
 from samba.gp_scripts_ext import gp_scripts_ext
 from samba.gp_sudoers_ext import gp_sudoers_ext
+from samba.vgp_sudoers_ext import vgp_sudoers_ext
 from samba.gpclass import gp_inf_ext
 from samba.gp_smb_conf_ext import gp_smb_conf_ext
 import logging
@@ -37,6 +38,7 @@ from samba.dcerpc import preg
 from samba.ndr import ndr_pack
 import codecs
 from shutil import copyfile
+import xml.etree.ElementTree as etree
 
 realm = os.environ.get('REALM')
 policies = realm + '/POLICIES'
@@ -440,6 +442,72 @@ class GPOTests(tests.TestCase):
         # Unstage the Registry.pol file
         unstage_file(reg_pol)
 
+    def test_vgp_sudoers(self):
+        local_path = self.lp.cache_path('gpo_cache')
+        guid = '{31B2F340-016D-11D2-945F-00C04FB984F9}'
+        manifest = os.path.join(local_path, policies, guid, 'MACHINE',
+            'VGP/VTLA/SUDO/SUDOERSCONFIGURATION/MANIFEST.XML')
+        logger = logging.getLogger('gpo_tests')
+        cache_dir = self.lp.get('cache directory')
+        store = GPOStorage(os.path.join(cache_dir, 'gpo.tdb'))
+
+        machine_creds = Credentials()
+        machine_creds.guess(self.lp)
+        machine_creds.set_machine_account()
+
+        # Initialize the group policy extension
+        ext = vgp_sudoers_ext(logger, self.lp, machine_creds, store)
+
+        ads = gpo.ADS_STRUCT(self.server, self.lp, machine_creds)
+        if ads.connect():
+            gpos = ads.get_gpo_list(machine_creds.get_username())
+
+        # Stage the manifest.xml file with test data
+        stage = etree.Element('vgppolicy')
+        policysetting = etree.Element('policysetting')
+        stage.append(policysetting)
+        version = etree.Element('version')
+        version.text = '1'
+        policysetting.append(version)
+        data = etree.Element('data')
+        sudoers_entry = etree.Element('sudoers_entry')
+        command = etree.Element('command')
+        command.text = 'ALL'
+        sudoers_entry.append(command)
+        user = etree.Element('user')
+        user.text = 'ALL'
+        sudoers_entry.append(user)
+        principal_list = etree.Element('listelement')
+        principal = etree.Element('principal')
+        principal.text = 'fakeu'
+        principal.attrib['type'] = 'user'
+        principal_list.append(principal)
+        sudoers_entry.append(principal_list)
+        data.append(sudoers_entry)
+        policysetting.append(data)
+        ret = stage_file(manifest, etree.tostring(stage))
+        self.assertTrue(ret, 'Could not create the target %s' % manifest)
+
+        # Process all gpos, with temp output directory
+        data = 'fakeu ALL=(ALL) NOPASSWD: ALL'
+        with TemporaryDirectory() as dname:
+            ext.process_group_policy([], gpos, dname)
+            sudoers = os.listdir(dname)
+            self.assertEquals(len(sudoers), 1, 'The sudoer file was not created')
+            self.assertIn(data,
+                    open(os.path.join(dname, sudoers[0]), 'r').read(),
+                    'The sudoers entry was not applied')
+
+            # Remove policy
+            gp_db = store.get_gplog(machine_creds.get_username())
+            del_gpos = get_deleted_gpos_list(gp_db, [])
+            ext.process_group_policy(del_gpos, [])
+            self.assertEquals(len(os.listdir(dname)), 0,
+                              'Unapply failed to cleanup scripts')
+
+        # Unstage the Registry.pol file
+        unstage_file(manifest)
+
     def test_gp_inf_ext_utf(self):
         logger = logging.getLogger('gpo_tests')
         cache_dir = self.lp.get('cache directory')
diff --git a/python/samba/vgp_sudoers_ext.py b/python/samba/vgp_sudoers_ext.py
new file mode 100644
index 00000000000..278f3558cc2
--- /dev/null
+++ b/python/samba/vgp_sudoers_ext.py
@@ -0,0 +1,101 @@
+# vgp_sudoers_ext samba gpo policy
+# Copyright (C) David Mulder <dmulder at suse.com> 2020
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+from samba.gpclass import gp_xml_ext
+from base64 import b64encode
+from tempfile import NamedTemporaryFile
+from subprocess import Popen, PIPE
+from samba.gp_sudoers_ext import visudo, intro
+
+class vgp_sudoers_ext(gp_xml_ext):
+    def __str__(self):
+        return 'VGP/Unix Settings/Sudo Rights'
+
+    def process_group_policy(self, deleted_gpo_list, changed_gpo_list,
+            sdir='/etc/sudoers.d'):
+        for guid, settings in deleted_gpo_list:
+            self.gp_db.set_guid(guid)
+            if str(self) in settings:
+                for attribute, sudoers in settings[str(self)].items():
+                    if os.path.exists(sudoers):
+                        os.unlink(sudoers)
+                    self.gp_db.delete(str(self), attribute)
+            self.gp_db.commit()
+
+        for gpo in changed_gpo_list:
+            if gpo.file_sys_path:
+                self.gp_db.set_guid(gpo.name)
+                xml = 'MACHINE/VGP/VTLA/Sudo/SudoersConfiguration/manifest.xml'
+                path = os.path.join(gpo.file_sys_path, xml)
+                xml_conf = self.parse(path)
+                if not xml_conf:
+                    continue
+                policy = xml_conf.find('policysetting')
+                data = policy.find('data')
+                for entry in data.findall('sudoers_entry'):
+                    command = entry.find('command').text
+                    user = entry.find('user').text
+                    principals = [p.text for p in entry.find('listelement').findall('principal')]
+                    nopassword = entry.find('password') == None
+                    np_entry = ' NOPASSWD:' if nopassword else ''
+                    p = '%s ALL=(%s)%s %s' % (','.join(principals), user, np_entry, command)
+                    attribute = b64encode(p.encode()).decode()
+                    old_val = self.gp_db.retrieve(str(self), attribute)
+                    if not old_val:
+                        contents = intro
+                        contents += '%s\n' % p
+                        with NamedTemporaryFile() as f:
+                            with open(f.name, 'w') as w:
+                                w.write(contents)
+                            sudo_validation = \
+                                    Popen([visudo, '-c', '-f', f.name],
+                                        stdout=PIPE, stderr=PIPE).wait()
+                        if sudo_validation == 0:
+                            with NamedTemporaryFile(prefix='gp_',
+                                                    delete=False,
+                                                    dir=sdir) as f:
+                                with open(f.name, 'w') as w:
+                                    w.write(contents)
+                                self.gp_db.store(str(self),
+                                                 attribute,
+                                                 f.name)
+                        else:
+                            self.logger.warn('Sudoers apply "%s" failed'
+                                    % p)
+                    self.gp_db.commit()
+
+    def rsop(self, gpo):
+        output = {}
+        xml = 'MACHINE/VGP/VTLA/Sudo/SudoersConfiguration/manifest.xml'
+        if gpo.file_sys_path:
+            path = os.path.join(gpo.file_sys_path, xml)
+            xml_conf = self.parse(path)
+            if not xml_conf:
+                return output
+            policy = xml_conf.find('policysetting')
+            data = policy.find('data')
+            for entry in data.findall('sudoers_entry'):
+                command = entry.find('command').text
+                user = entry.find('user').text
+                principals = [p.text for p in entry.find('listelement').findall('principal')]
+                nopassword = entry.find('password') == None
+                np_entry = ' NOPASSWD:' if nopassword else ''
+                p = '%s ALL=(%s)%s %s' % (','.join(principals), user, np_entry, command)
+                if str(self) not in output.keys():
+                    output[str(self)] = []
+                output[str(self)].append(p)
+        return output
diff --git a/source4/scripting/bin/samba-gpupdate b/source4/scripting/bin/samba-gpupdate
index dfbb1901457..85300e15655 100755
--- a/source4/scripting/bin/samba-gpupdate
+++ b/source4/scripting/bin/samba-gpupdate
@@ -34,6 +34,7 @@ from samba.gp_sec_ext import gp_krb_ext, gp_access_ext
 from samba.gp_ext_loader import get_gp_client_side_extensions
 from samba.gp_scripts_ext import gp_scripts_ext
 from samba.gp_sudoers_ext import gp_sudoers_ext
+from samba.vgp_sudoers_ext import vgp_sudoers_ext
 from samba.gp_smb_conf_ext import gp_smb_conf_ext
 from samba.gp_msgs_ext import gp_msgs_ext
 import logging
@@ -89,6 +90,7 @@ if __name__ == "__main__":
         gp_extensions.append(gp_krb_ext)
         gp_extensions.append(gp_scripts_ext)
         gp_extensions.append(gp_sudoers_ext)
+        gp_extensions.append(vgp_sudoers_ext)
         gp_extensions.append(gp_smb_conf_ext)
         gp_extensions.append(gp_msgs_ext)
         gp_extensions.extend(machine_exts)


-- 
Samba Shared Repository


From bjacke at samba.org  Sat Dec 19 18:21:01 2020
From: bjacke at samba.org (=?UTF-8?Q?Bj=C3=B6rn_Jacke?=)
Date: Sat, 19 Dec 2020 18:21:01 +0000
Subject: [SCM] Samba Shared Repository - branch master updated
Message-ID: <E1kqgqj-00B3YJ-Hr@hrx0.samba.org>

The branch, master has been updated
       via  18d68e85c8a dns_update.c: handle DNS_QTYPE_ALL
      from  9b44f7a71ec gpo: Apply Group Policy Sudo Rights from VGP

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 18d68e85c8a1ef7fd570d3d3fd4dde484aea417e
Author: Bj?rn Jacke <bj at sernet.de>
Date:   Thu Nov 19 12:18:28 2020 +0100

    dns_update.c: handle DNS_QTYPE_ALL
    
    we have code to handle this, we should not refuse the request
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14576
    
    Signed-off-by: Bjoern Jacke <bjacke at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>
    
    Autobuild-User(master): Bj?rn Jacke <bjacke at samba.org>
    Autobuild-Date(master): Sat Dec 19 18:20:30 UTC 2020 on sn-devel-184

-----------------------------------------------------------------------

Summary of changes:
 source4/dns_server/dns_update.c | 1 +
 1 file changed, 1 insertion(+)


Changeset truncated at 500 lines:

diff --git a/source4/dns_server/dns_update.c b/source4/dns_server/dns_update.c
index b6d39e4c034..529ee7894a3 100644
--- a/source4/dns_server/dns_update.c
+++ b/source4/dns_server/dns_update.c
@@ -413,6 +413,7 @@ static WERROR handle_one_update(struct dns_server *dns,
 	case DNS_QTYPE_AAAA:
 	case DNS_QTYPE_SRV:
 	case DNS_QTYPE_TXT:
+	case DNS_QTYPE_ALL:
 		break;
 	default:
 		DEBUG(0, ("Can't handle updates of type %u yet\n",


-- 
Samba Shared Repository


From gary at samba.org  Mon Dec 21 21:30:02 2020
From: gary at samba.org (Gary Lockyer)
Date: Mon, 21 Dec 2020 21:30:02 +0000
Subject: [SCM] Samba Shared Repository - branch master updated
Message-ID: <E1krSkk-00Cbmz-77@hrx0.samba.org>

The branch, master has been updated
       via  c00d537526c tests python krb5: PEP8 cleanups
       via  03676a4a5c5 tests python krb5: use key usage constants
       via  d8ed73b75ad tests python krb5: Add key usage constants
      from  18d68e85c8a dns_update.c: handle DNS_QTYPE_ALL

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit c00d537526ca881c540ff66e703ad9c96dd1face
Author: Gary Lockyer <gary at catalyst.net.nz>
Date:   Fri Dec 11 11:55:01 2020 +1300

    tests python krb5: PEP8 cleanups
    
    Fix all the PEP8 warnings in samba/tests/krb5. With the exception of
    rfc4120_pyasn1.py, which is generated from rfc4120.asn1.
    
    As these tests are new, it makes sense to ensure that they conform to
    PEP8. And set an aspirational goal for the rest of our python code.
    
    Signed-off-by: Gary Lockyer <gary at catalyst.net.nz>
    Reviewed-by: Andreas Schneider <asn at samba.org>
    
    Autobuild-User(master): Gary Lockyer <gary at samba.org>
    Autobuild-Date(master): Mon Dec 21 21:29:28 UTC 2020 on sn-devel-184

commit 03676a4a5c55ab5f4958a86cbd4d7be0f0a8a294
Author: Gary Lockyer <gary at catalyst.net.nz>
Date:   Thu Dec 10 16:27:17 2020 +1300

    tests python krb5: use key usage constants
    
    Signed-off-by: Gary Lockyer <gary at catalyst.net.nz>
    Reviewed-by: Andreas Schneider <asn at samba.org>

commit d8ed73b75ad67da99be392b2db18fe2e1ffed87f
Author: Gary Lockyer <gary at catalyst.net.nz>
Date:   Thu Dec 10 16:26:06 2020 +1300

    tests python krb5: Add key usage constants
    
    Signed-off-by: Gary Lockyer <gary at catalyst.net.nz>
    Reviewed-by: Andreas Schneider <asn at samba.org>

-----------------------------------------------------------------------

Summary of changes:
 .../samba/tests/krb5/as_canonicalization_tests.py  |  59 +--
 python/samba/tests/krb5/compatability_tests.py     |  31 +-
 python/samba/tests/krb5/kcrypto.py                 |  67 ++--
 python/samba/tests/krb5/kdc_base_test.py           |  20 +-
 python/samba/tests/krb5/kdc_tests.py               |  20 +-
 python/samba/tests/krb5/raw_testcase.py            | 409 ++++++++++++---------
 python/samba/tests/krb5/rfc4120_constants.py       |  82 ++++-
 python/samba/tests/krb5/s4u_tests.py               |  34 +-
 python/samba/tests/krb5/simple_tests.py            |  39 +-
 python/samba/tests/krb5/xrealm_tests.py            |  41 ++-
 10 files changed, 505 insertions(+), 297 deletions(-)


Changeset truncated at 500 lines:

diff --git a/python/samba/tests/krb5/as_canonicalization_tests.py b/python/samba/tests/krb5/as_canonicalization_tests.py
index 6ea3ff0491e..43f532dc483 100755
--- a/python/samba/tests/krb5/as_canonicalization_tests.py
+++ b/python/samba/tests/krb5/as_canonicalization_tests.py
@@ -31,8 +31,6 @@ import samba
 from samba.auth import system_session
 from samba.credentials import (
     Credentials,
-    CLI_CRED_NTLMv2_AUTH,
-    CLI_CRED_NTLM_AUTH,
     DONT_USE_KERBEROS)
 from samba.dcerpc.misc import SEC_CHAN_WKSTA
 from samba.dsdb import (
@@ -41,7 +39,20 @@ from samba.dsdb import (
     UF_NORMAL_ACCOUNT)
 from samba.samdb import SamDB
 from samba.tests import delete_force, DynamicTestCase
-from samba.tests.krb5.rfc4120_constants import *
+from samba.tests.krb5.rfc4120_constants import (
+    AES256_CTS_HMAC_SHA1_96,
+    AES128_CTS_HMAC_SHA1_96,
+    ARCFOUR_HMAC_MD5,
+    KDC_ERR_PREAUTH_REQUIRED,
+    KRB_AS_REP,
+    KU_AS_REP_ENC_PART,
+    KRB_ERROR,
+    KU_PA_ENC_TIMESTAMP,
+    PADATA_ENC_TIMESTAMP,
+    NT_ENTERPRISE_PRINCIPAL,
+    NT_PRINCIPAL,
+    NT_SRV_INST,
+)
 
 global_asn1_print = False
 global_hexdump = False
@@ -49,15 +60,15 @@ global_hexdump = False
 
 @unique
 class TestOptions(Enum):
-    Canonicalize  =   1
-    Enterprise    =   2
-    UpperRealm    =   4
-    UpperUserName =   8
-    NetbiosRealm  =  16
-    UPN           =  32
-    RemoveDollar  =  64
-    AsReqSelf     = 128
-    Last          = 256
+    Canonicalize = 1
+    Enterprise = 2
+    UpperRealm = 4
+    UpperUserName = 8
+    NetbiosRealm = 16
+    UPN = 32
+    RemoveDollar = 64
+    AsReqSelf = 128
+    Last = 256
 
     def is_set(self, x):
         return self.value & x
@@ -65,7 +76,7 @@ class TestOptions(Enum):
 
 @unique
 class CredentialsType(Enum):
-    User    = 1
+    User = 1
     Machine = 2
 
     def is_set(self, x):
@@ -126,7 +137,8 @@ class TestData:
 
 
 MACHINE_NAME = "tstkrb5cnnmch"
-USER_NAME    = "tstkrb5cnnusr"
+USER_NAME = "tstkrb5cnnusr"
+
 
 @DynamicTestCase
 class KerberosASCanonicalizationTests(RawKerberosTest):
@@ -160,21 +172,21 @@ class KerberosASCanonicalizationTests(RawKerberosTest):
 
     @classmethod
     def setUpClass(cls):
-        cls.lp       = cls.get_loadparm(cls)
+        cls.lp = cls.get_loadparm(cls)
         cls.username = os.environ["USERNAME"]
         cls.password = os.environ["PASSWORD"]
-        cls.host     = os.environ["SERVER"]
+        cls.host = os.environ["SERVER"]
 
         c = Credentials()
         c.set_username(cls.username)
         c.set_password(cls.password)
         try:
-            realm    = os.environ["REALM"]
+            realm = os.environ["REALM"]
             c.set_realm(realm)
         except KeyError:
             pass
         try:
-            domain    = os.environ["DOMAIN"]
+            domain = os.environ["DOMAIN"]
             c.set_domain(domain)
         except KeyError:
             pass
@@ -200,7 +212,7 @@ class KerberosASCanonicalizationTests(RawKerberosTest):
     def setUp(self):
         super(KerberosASCanonicalizationTests, self).setUp()
         self.do_asn1_print = global_asn1_print
-        self.do_hexdump    = global_hexdump
+        self.do_hexdump = global_hexdump
 
     #
     # Create a test user account
@@ -340,7 +352,7 @@ class KerberosASCanonicalizationTests(RawKerberosTest):
         #
         # Check the protocol version, should be 5
         self.assertEqual(
-                rep['pvno'], 5, "Data {0}".format(str(data)))
+            rep['pvno'], 5, "Data {0}".format(str(data)))
 
         self.assertEqual(
             rep['msg-type'], KRB_ERROR, "Data {0}".format(str(data)))
@@ -367,8 +379,7 @@ class KerberosASCanonicalizationTests(RawKerberosTest):
         pa_ts = self.PA_ENC_TS_ENC_create(patime, pausec)
         pa_ts = self.der_encode(pa_ts, asn1Spec=krb5_asn1.PA_ENC_TS_ENC())
 
-        enc_pa_ts_usage = 1
-        pa_ts = self.EncryptedData_create(key, enc_pa_ts_usage, pa_ts)
+        pa_ts = self.EncryptedData_create(key, KU_PA_ENC_TIMESTAMP, pa_ts)
         pa_ts = self.der_encode(pa_ts, asn1Spec=krb5_asn1.EncryptedData())
 
         pa_ts = self.PA_DATA_create(PADATA_ENC_TIMESTAMP, pa_ts)
@@ -398,7 +409,7 @@ class KerberosASCanonicalizationTests(RawKerberosTest):
         #
         # Check the protocol version, should be 5
         self.assertEqual(
-                rep['pvno'], 5, "Data {0}".format(str(data)))
+            rep['pvno'], 5, "Data {0}".format(str(data)))
 
         msg_type = rep['msg-type']
         # Should not have got an error.
@@ -413,7 +424,7 @@ class KerberosASCanonicalizationTests(RawKerberosTest):
         self.assertEqual(msg_type, KRB_AS_REP, "Data {0}".format(str(data)))
 
         # Decrypt and decode the EncKdcRepPart
-        enc = key.decrypt(3, rep['enc-part']['cipher'])
+        enc = key.decrypt(KU_AS_REP_ENC_PART, rep['enc-part']['cipher'])
         if enc[0] == 0x7A:
             # MIT Kerberos Tags the EncASRepPart as a EncKDCRepPart
             # i.e. tag number 26 instead of tag number 25
diff --git a/python/samba/tests/krb5/compatability_tests.py b/python/samba/tests/krb5/compatability_tests.py
index e4b1453e712..5a1ef02ef80 100755
--- a/python/samba/tests/krb5/compatability_tests.py
+++ b/python/samba/tests/krb5/compatability_tests.py
@@ -25,7 +25,20 @@ os.environ["PYTHONUNBUFFERED"] = "1"
 
 from samba.tests.krb5.raw_testcase import RawKerberosTest
 import samba.tests.krb5.rfc4120_pyasn1 as krb5_asn1
-from samba.tests.krb5.rfc4120_constants import *
+from samba.tests.krb5.rfc4120_constants import (
+    AES128_CTS_HMAC_SHA1_96,
+    AES256_CTS_HMAC_SHA1_96,
+    ARCFOUR_HMAC_MD5,
+    KDC_ERR_PREAUTH_REQUIRED,
+    KRB_AS_REP,
+    KRB_ERROR,
+    KU_AS_REP_ENC_PART,
+    KU_PA_ENC_TIMESTAMP,
+    PADATA_ENC_TIMESTAMP,
+    PADATA_ETYPE_INFO2,
+    NT_PRINCIPAL,
+    NT_SRV_INST,
+)
 
 global_asn1_print = False
 global_hexdump = False
@@ -112,18 +125,17 @@ class SimpleKerberosTests(RawKerberosTest):
         realm = creds.get_realm()
 
         cname = self.PrincipalName_create(
-                name_type=NT_PRINCIPAL,
-                names=[user])
+            name_type=NT_PRINCIPAL,
+            names=[user])
         sname = self.PrincipalName_create(
-                name_type=NT_SRV_INST,
-                names=["krbtgt", realm])
+            name_type=NT_SRV_INST,
+            names=["krbtgt", realm])
 
         till = self.get_KerberosTime(offset=36000)
 
         kdc_options = krb5_asn1.KDCOptions('forwardable')
         padata = None
 
-
         req = self.AS_REQ_create(padata=padata,
                                  kdc_options=str(kdc_options),
                                  cname=cname,
@@ -178,8 +190,7 @@ class SimpleKerberosTests(RawKerberosTest):
         pa_ts = self.PA_ENC_TS_ENC_create(patime, pausec)
         pa_ts = self.der_encode(pa_ts, asn1Spec=krb5_asn1.PA_ENC_TS_ENC())
 
-        enc_pa_ts_usage = 1
-        pa_ts = self.EncryptedData_create(key, enc_pa_ts_usage, pa_ts)
+        pa_ts = self.EncryptedData_create(key, KU_PA_ENC_TIMESTAMP, pa_ts)
         pa_ts = self.der_encode(pa_ts, asn1Spec=krb5_asn1.EncryptedData())
 
         pa_ts = self.PA_DATA_create(PADATA_ENC_TIMESTAMP, pa_ts)
@@ -207,9 +218,9 @@ class SimpleKerberosTests(RawKerberosTest):
         msg_type = rep['msg-type']
         self.assertEqual(msg_type, KRB_AS_REP)
 
-        usage = 3
         enc_part = rep['enc-part']
-        enc_as_rep_part = key.decrypt(usage, rep['enc-part']['cipher'])
+        enc_as_rep_part = key.decrypt(
+            KU_AS_REP_ENC_PART, rep['enc-part']['cipher'])
         return (enc_as_rep_part, enc_part)
 
 
diff --git a/python/samba/tests/krb5/kcrypto.py b/python/samba/tests/krb5/kcrypto.py
index 64bdbecd8b2..c8fef4c876d 100755
--- a/python/samba/tests/krb5/kcrypto.py
+++ b/python/samba/tests/krb5/kcrypto.py
@@ -64,6 +64,7 @@ from samba.credentials import Credentials
 from samba import generate_random_bytes as get_random_bytes
 from samba.common import get_string, get_bytes
 
+
 class Enctype(object):
     DES_CRC = 1
     DES_MD4 = 2
@@ -112,26 +113,30 @@ def _mac_equal(mac1, mac2):
         res |= x ^ y
     return res == 0
 
+
 def SIMPLE_HASH(string, algo_cls):
     hash_ctx = hashes.Hash(algo_cls(), default_backend())
     hash_ctx.update(string)
     return hash_ctx.finalize()
 
+
 def HMAC_HASH(key, string, algo_cls):
     hmac_ctx = hmac.HMAC(key, algo_cls(), default_backend())
     hmac_ctx.update(string)
     return hmac_ctx.finalize()
 
+
 def _nfold(str, nbytes):
     # Convert str to a string of length nbytes using the RFC 3961 nfold
     # operation.
 
     # Rotate the bytes in str to the right by nbits bits.
     def rotate_right(str, nbits):
-        nbytes, remain = (nbits//8) % len(str), nbits % 8
-        return bytes([(str[i-nbytes] >> remain) |
-                      (str[i-nbytes-1] << (8-remain) & 0xff)
-                      for i in range(len(str))])
+        nbytes, remain = (nbits // 8) % len(str), nbits % 8
+        return bytes([
+            (str[i - nbytes] >> remain)
+            | (str[i - nbytes - 1] << (8 - remain) & 0xff)
+            for i in range(len(str))])
 
     # Add equal-length strings together with end-around carry.
     def add_ones_complement(str1, str2):
@@ -139,7 +144,7 @@ def _nfold(str, nbytes):
         v = [a + b for a, b in zip(str1, str2)]
         # Propagate carry bits to the left until there aren't any left.
         while any(x & ~0xff for x in v):
-            v = [(v[i-n+1]>>8) + (v[i]&0xff) for i in range(n)]
+            v = [(v[i - n + 1] >> 8) + (v[i] & 0xff) for i in range(n)]
         return bytes([x for x in v])
 
     # Concatenate copies of str to produce the least common multiple
@@ -150,7 +155,7 @@ def _nfold(str, nbytes):
     slen = len(str)
     lcm = nbytes * slen // gcd(nbytes, slen)
     bigstr = b''.join((rotate_right(str, 13 * i) for i in range(lcm // slen)))
-    slices = (bigstr[p:p+nbytes] for p in range(0, lcm, nbytes))
+    slices = (bigstr[p:p + nbytes] for p in range(0, lcm, nbytes))
     return reduce(add_ones_complement, slices)
 
 
@@ -275,7 +280,7 @@ class _DES3CBC(_SimplifiedEnctype):
                 return b if bin(b & ~1).count('1') % 2 else b | 1
             assert len(seed) == 7
             firstbytes = [parity(b & ~1) for b in seed]
-            lastbyte = parity(sum((seed[i]&1) << i+1 for i in range(7)))
+            lastbyte = parity(sum((seed[i] & 1) << i + 1 for i in range(7)))
             keybytes = bytes([b for b in firstbytes + [lastbyte]])
             if _is_weak_des_key(keybytes):
                 keybytes[7] = bytes([keybytes[7] ^ 0xF0])
@@ -369,7 +374,7 @@ class _AESEnctype(_SimplifiedEnctype):
         if len(ciphertext) == 16:
             return aes_decrypt(ciphertext)
         # Split the ciphertext into blocks.  The last block may be partial.
-        cblocks = [ciphertext[p:p+16] for p in range(0, len(ciphertext), 16)]
+        cblocks = [ciphertext[p:p + 16] for p in range(0, len(ciphertext), 16)]
         lastlen = len(cblocks[-1])
         # CBC-decrypt all but the last two blocks.
         prev_cblock = bytes(16)
@@ -383,7 +388,7 @@ class _AESEnctype(_SimplifiedEnctype):
         # will be the omitted bytes of ciphertext from the final
         # block.
         b = aes_decrypt(cblocks[-2])
-        lastplaintext =_xorbytes(b[:lastlen], cblocks[-1])
+        lastplaintext = _xorbytes(b[:lastlen], cblocks[-1])
         omitted = b[lastlen:]
         # Decrypt the final cipher block plus the omitted bytes to get
         # the second-to-last plaintext block.
@@ -433,7 +438,8 @@ class _RC4(_EnctypeProfile):
         cksum = HMAC_HASH(ki, confounder + plaintext, hashes.MD5)
         ke = HMAC_HASH(ki, cksum, hashes.MD5)
 
-        encryptor = Cipher(ciphers.ARC4(ke), None, default_backend()).encryptor()
+        encryptor = Cipher(
+            ciphers.ARC4(ke), None, default_backend()).encryptor()
         ctext = encryptor.update(confounder + plaintext)
 
         return cksum + ctext
@@ -446,7 +452,8 @@ class _RC4(_EnctypeProfile):
         ki = HMAC_HASH(key.contents, cls.usage_str(keyusage), hashes.MD5)
         ke = HMAC_HASH(ki, cksum, hashes.MD5)
 
-        decryptor = Cipher(ciphers.ARC4(ke), None, default_backend()).decryptor()
+        decryptor = Cipher(
+            ciphers.ARC4(ke), None, default_backend()).decryptor()
         basic_plaintext = decryptor.update(basic_ctext)
 
         exp_cksum = HMAC_HASH(ki, basic_plaintext, hashes.MD5)
@@ -636,14 +643,14 @@ def verify_checksum(cksumtype, key, keyusage, text, cksum):
     c.verify(key, keyusage, text, cksum)
 
 
-def prfplus(key, pepper, l):
-    # Produce l bytes of output using the RFC 6113 PRF+ function.
+def prfplus(key, pepper, ln):
+    # Produce ln bytes of output using the RFC 6113 PRF+ function.
     out = b''
     count = 1
-    while len(out) < l:
+    while len(out) < ln:
         out += prf(key, bytes([count]) + pepper)
         count += 1
-    return out[:l]
+    return out[:ln]
 
 
 def cf2(enctype, key1, key2, pepper1, pepper2):
@@ -653,9 +660,11 @@ def cf2(enctype, key1, key2, pepper1, pepper2):
     return e.random_to_key(_xorbytes(prfplus(key1, pepper1, e.seedsize),
                                      prfplus(key2, pepper2, e.seedsize)))
 
+
 def h(hexstr):
     return bytes.fromhex(hexstr)
 
+
 class KcrytoTest(TestCase):
     """kcrypto Test case."""
 
@@ -665,20 +674,21 @@ class KcrytoTest(TestCase):
         conf = h('94B491F481485B9A0678CD3C4EA386AD')
         keyusage = 2
         plain = b'9 bytesss'
-        ctxt = h('68FB9679601F45C78857B2BF820FD6E53ECA8D42FD4B1D7024A09205ABB7CD2E'
-                 'C26C355D2F')
+        ctxt = h('68FB9679601F45C78857B2BF820FD6E53ECA8D42FD4B1D7024A09205ABB7'
+                 'CD2EC26C355D2F')
         k = Key(Enctype.AES128, kb)
         self.assertEqual(encrypt(k, keyusage, plain, conf), ctxt)
         self.assertEqual(decrypt(k, keyusage, ctxt), plain)
 
     def test_aes256_crypt(self):
         # AES256 encrypt and decrypt
-        kb = h('F1C795E9248A09338D82C3F8D5B567040B0110736845041347235B1404231398')
+        kb = h('F1C795E9248A09338D82C3F8D5B567040B0110736845041347235B14042313'
+               '98')
         conf = h('E45CA518B42E266AD98E165E706FFB60')
         keyusage = 4
         plain = b'30 bytes bytes bytes bytes byt'
-        ctxt = h('D1137A4D634CFECE924DBC3BF6790648BD5CFF7DE0E7B99460211D0DAEF3D79A'
-                 '295C688858F3B34B9CBD6EEBAE81DAF6B734D4D498B6714F1C1D')
+        ctxt = h('D1137A4D634CFECE924DBC3BF6790648BD5CFF7DE0E7B99460211D0DAEF3'
+                 'D79A295C688858F3B34B9CBD6EEBAE81DAF6B734D4D498B6714F1C1D')
         k = Key(Enctype.AES256, kb)
         self.assertEqual(encrypt(k, keyusage, plain, conf), ctxt)
         self.assertEqual(decrypt(k, keyusage, ctxt), plain)
@@ -694,7 +704,8 @@ class KcrytoTest(TestCase):
 
     def test_aes256_checksum(self):
         # AES256 checksum
-        kb = h('B1AE4CD8462AFF1677053CC9279AAC30B796FB81CE21474DD3DDBCFEA4EC76D7')
+        kb = h('B1AE4CD8462AFF1677053CC9279AAC30B796FB81CE21474DD3DDBC'
+               'FEA4EC76D7')
         keyusage = 4
         plain = b'fourteen'
         cksum = h('E08739E3279E2903EC8E3836')
@@ -715,7 +726,8 @@ class KcrytoTest(TestCase):
         string = b'X' * 64
         salt = b'pass phrase equals block size'
         params = h('000004B0')
-        kb = h('89ADEE3608DB8BC71F1BFBFE459486B05618B70CBAE22092534E56C553BA4B34')
+        kb = h('89ADEE3608DB8BC71F1BFBFE459486B05618B70CBAE22092534E56'
+               'C553BA4B34')
         k = string_to_key(Enctype.AES256, string, salt, params)
         self.assertEqual(k.contents, kb)
 
@@ -741,7 +753,8 @@ class KcrytoTest(TestCase):
 
     def test_aes256_cf2(self):
         # AES256 cf2
-        kb = h('4D6CA4E629785C1F01BAF55E2E548566B9617AE3A96868C337CB93B5E72B1C7B')
+        kb = h('4D6CA4E629785C1F01BAF55E2E548566B9617AE3A96868C337CB93B5'
+               'E72B1C7B')
         k1 = string_to_key(Enctype.AES256, b'key1', b'key1')
         k2 = string_to_key(Enctype.AES256, b'key2', b'key2')
         k = cf2(Enctype.AES256, k1, k2, b'a', b'b')
@@ -753,8 +766,8 @@ class KcrytoTest(TestCase):
         conf = h('94690A17B2DA3C9B')
         keyusage = 3
         plain = b'13 bytes byte'
-        ctxt = h('839A17081ECBAFBCDC91B88C6955DD3C4514023CF177B77BF0D0177A16F705E8'
-                 '49CB7781D76A316B193F8D30')
+        ctxt = h('839A17081ECBAFBCDC91B88C6955DD3C4514023CF177B77BF0D0177A16F7'
+                 '05E849CB7781D76A316B193F8D30')
         k = Key(Enctype.DES3, kb)
         self.assertEqual(encrypt(k, keyusage, plain, conf), ctxt)
         self.assertEqual(decrypt(k, keyusage, ctxt), _zeropad(plain, 8))
@@ -790,8 +803,8 @@ class KcrytoTest(TestCase):
         conf = h('37245E73A45FBF72')
         keyusage = 4
         plain = b'30 bytes bytes bytes bytes byt'
-        ctxt = h('95F9047C3AD75891C2E9B04B16566DC8B6EB9CE4231AFB2542EF87A7B5A0F260'
-                 'A99F0460508DE0CECC632D07C354124E46C5D2234EB8')
+        ctxt = h('95F9047C3AD75891C2E9B04B16566DC8B6EB9CE4231AFB2542EF87A7B5A0'
+                 'F260A99F0460508DE0CECC632D07C354124E46C5D2234EB8')
         k = Key(Enctype.RC4, kb)
         self.assertEqual(encrypt(k, keyusage, plain, conf), ctxt)
         self.assertEqual(decrypt(k, keyusage, ctxt), plain)
diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py
index 1a823d173e3..bef5458c881 100644
--- a/python/samba/tests/krb5/kdc_base_test.py
+++ b/python/samba/tests/krb5/kdc_base_test.py
@@ -41,6 +41,10 @@ from samba.tests.krb5.rfc4120_constants import (
     KRB_AS_REP,
     KRB_TGS_REP,
     KRB_ERROR,
+    KU_AS_REP_ENC_PART,
+    KU_PA_ENC_TIMESTAMP,
+    KU_TGS_REP_ENC_PART_SUB_KEY,
+    KU_TICKET,
     PADATA_ENC_TIMESTAMP,
     PADATA_ETYPE_INFO2,
 )
@@ -196,8 +200,7 @@ class KDCBaseTest(RawKerberosTest):
         padata = self.PA_ENC_TS_ENC_create(patime, pausec)
         padata = self.der_encode(padata, asn1Spec=krb5_asn1.PA_ENC_TS_ENC())
 
-        usage = 1
-        padata = self.EncryptedData_create(key, usage, padata)
+        padata = self.EncryptedData_create(key, KU_PA_ENC_TIMESTAMP, padata)
         padata = self.der_encode(padata, asn1Spec=krb5_asn1.EncryptedData())
 
         padata = self.PA_DATA_create(PADATA_ENC_TIMESTAMP, padata)
@@ -207,8 +210,7 @@ class KDCBaseTest(RawKerberosTest):
     def get_as_rep_enc_data(self, key, rep):
         ''' Decrypt and Decode the encrypted data in an AS-REP
         '''
-        usage = 3
-        enc_part = key.decrypt(usage, rep['enc-part']['cipher'])
+        enc_part = key.decrypt(KU_AS_REP_ENC_PART, rep['enc-part']['cipher'])
         # MIT KDC encodes both EncASRepPart and EncTGSRepPart with
         # application tag 26
         try:
@@ -303,7 +305,6 @@ class KDCBaseTest(RawKerberosTest):
         padata = []
 
         subkey = self.RandomKey(key.etype)
-        subkey_usage = 9
 
         (ctime, cusec) = self.get_KerberosTimeWithUsec()
 
@@ -332,7 +333,8 @@ class KDCBaseTest(RawKerberosTest):
         msg_type = rep['msg-type']
         enc_part = None
         if msg_type == KRB_TGS_REP:
-            enc_part = subkey.decrypt(subkey_usage, rep['enc-part']['cipher'])
+            enc_part = subkey.decrypt(
+                KU_TGS_REP_ENC_PART_SUB_KEY, rep['enc-part']['cipher'])
             enc_part = self.der_decode(
                 enc_part, asn1Spec=krb5_asn1.EncTGSRepPart())
         return (rep, enc_part)
@@ -372,8 +374,8 @@ class KDCBaseTest(RawKerberosTest):
                         account_name = (
                             pac.info.info.info3.base.account_name)


-- 
Samba Shared Repository


From bjacke at samba.org  Wed Dec 23 13:53:01 2020
From: bjacke at samba.org (=?UTF-8?Q?Bj=C3=B6rn_Jacke?=)
Date: Wed, 23 Dec 2020 13:53:01 +0000
Subject: [SCM] Samba Shared Repository - branch master updated
Message-ID: <E1ks4ZZ-00BAOf-D7@hrx0.samba.org>

The branch, master has been updated
       via  8fcde5912a9 net: remove obsolete net ads dns gethostbyname command
       via  985042d391e dnsupdates: clean up all RRSets and not only type A
       via  98caa173b24 tests: also test net ads dns (un)register with IPv6
       via  f30e100b396 tests: also test v6 for async dns test by using dig
      from  c00d537526c tests python krb5: PEP8 cleanups

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 8fcde5912a966c947adf2b5b313d224c9e827ca4
Author: Bj?rn Jacke <bj at sernet.de>
Date:   Tue Dec 22 21:04:34 2020 +0100

    net: remove obsolete net ads dns gethostbyname command
    
    net ads dns gethostbyname is doing the same as nslookup / host / dig and it's
    quite limited and only supports A records. We should just drop it.
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=13706
    
    Signed-off-by: Bjoern Jacke <bjacke at samba.org>
    Reviewed-by: Andrew Bartlett <abartlet at samba.org>
    
    Autobuild-User(master): Bj?rn Jacke <bjacke at samba.org>
    Autobuild-Date(master): Wed Dec 23 13:52:41 UTC 2020 on sn-devel-184

commit 985042d391e8124b157f21a6041ff9e17188483a
Author: Bj?rn Jacke <bj at sernet.de>
Date:   Tue Dec 22 17:23:16 2020 +0100

    dnsupdates: clean up all RRSets and not only type A
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=13706
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14244
    
    Signed-off-by: Bjoern Jacke <bjacke at samba.org>
    Reviewed-by: Andrew Bartlett <abartlet at samba.org>

commit 98caa173b2471f963283bbb9d1c32ca8129f7e0b
Author: Bj?rn Jacke <bj at sernet.de>
Date:   Tue Dec 22 18:10:44 2020 +0100

    tests: also test net ads dns (un)register with IPv6
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=13706
    
    Signed-off-by: Bjoern Jacke <bjacke at samba.org>
    Reviewed-by: Andrew Bartlett <abartlet at samba.org>

commit f30e100b39677f9a71200d324e5f9562909a343e
Author: Bj?rn Jacke <bj at sernet.de>
Date:   Tue Dec 22 17:28:41 2020 +0100

    tests: also test v6 for async dns test by using dig
    
    Signed-off-by: Bjoern Jacke <bjacke at samba.org>
    Reviewed-by: Andrew Bartlett <abartlet at samba.org>

-----------------------------------------------------------------------

Summary of changes:
 docs-xml/manpages/net.8.xml                  |  5 ----
 lib/addns/dnsrecord.c                        |  4 +--
 source3/utils/net_ads.c                      | 37 -----------------------
 source3/utils/net_dns.c                      | 44 ----------------------------
 source3/utils/net_dns.h                      |  2 --
 testprogs/blackbox/test_net_ads_dns.sh       | 26 +++++++---------
 testprogs/blackbox/test_net_ads_dns_async.sh | 19 ++++++++----
 7 files changed, 27 insertions(+), 110 deletions(-)


Changeset truncated at 500 lines:

diff --git a/docs-xml/manpages/net.8.xml b/docs-xml/manpages/net.8.xml
index 951ddcd7c3a..94689e96c98 100644
--- a/docs-xml/manpages/net.8.xml
+++ b/docs-xml/manpages/net.8.xml
@@ -1393,11 +1393,6 @@ against an NT4 Domain Controller.
 <para>Remove host dns entry from Active Directory.</para>
 </refsect3>
 
-<refsect3>
-<title>ADS DNS GETHOSTBYNAME &lt;NAMESERVER|HOSTNAME&gt;</title>
-<para>Look up the hostname from Active Directory. You can either provide nameserver ie IPv4|IPv6 address or the hostname. Only one should be provided at a time.</para>
-</refsect3>
-
 </refsect2>
 
 <refsect2>
diff --git a/lib/addns/dnsrecord.c b/lib/addns/dnsrecord.c
index 0d149373997..e6e205e6832 100644
--- a/lib/addns/dnsrecord.c
+++ b/lib/addns/dnsrecord.c
@@ -430,10 +430,10 @@ DNS_ERROR dns_create_update_request(TALLOC_CTX *mem_ctx,
 	if (!ERR_DNS_IS_OK(err)) goto error;
 
 	/*
-	 * Delete any existing A records
+	 * Delete all existing RRsets from our name
 	 */
 
-	err = dns_create_delete_record(req, hostname, QTYPE_A, DNS_CLASS_ANY,
+	err = dns_create_delete_record(req, hostname, QTYPE_ANY, DNS_CLASS_ANY,
 				       &rec);
 	if (!ERR_DNS_IS_OK(err)) goto error;
 
diff --git a/source3/utils/net_ads.c b/source3/utils/net_ads.c
index bcb9c9d5dde..c8b18a9c281 100644
--- a/source3/utils/net_ads.c
+++ b/source3/utils/net_ads.c
@@ -2190,35 +2190,6 @@ static int net_ads_dns_unregister(struct net_context *c,
 #endif
 }
 
-static int net_ads_dns_gethostbyname(struct net_context *c, int argc, const char **argv)
-{
-#if defined(WITH_DNS_UPDATES)
-	DNS_ERROR err;
-
-#ifdef DEVELOPER
-	talloc_enable_leak_report();
-#endif
-
-	if (argc != 2 || c->display_usage) {
-		d_printf(  "%s\n"
-			   "    %s\n"
-			   "    %s\n",
-			 _("Usage:"),
-			 _("net ads dns gethostbyname <server> <name>\n"),
-			 _("  Look up hostname from the AD\n"
-			   "    nameserver\tName server to use\n"
-			   "    hostname\tName to look up\n"));
-		return -1;
-	}
-
-	err = do_gethostbyname(argv[0], argv[1]);
-	if (!ERR_DNS_IS_OK(err)) {
-		d_printf(_("do_gethostbyname returned %s (%d)\n"),
-			dns_errstr(err), ERROR_DNS_V(err));
-	}
-#endif
-	return 0;
-}
 
 static int net_ads_dns_async(struct net_context *c, int argc, const char **argv)
 {
@@ -2313,14 +2284,6 @@ static int net_ads_dns(struct net_context *c, int argc, const char *argv[])
 			N_("net ads dns unregister\n"
 			   "    Remove host dns entry from AD")
 		},
-		{
-			"gethostbyname",
-			net_ads_dns_gethostbyname,
-			NET_TRANSPORT_ADS,
-			N_("Look up host"),
-			N_("net ads dns gethostbyname\n"
-			   "    Look up host")
-		},
 		{
 			"async",
 			net_ads_dns_async,
diff --git a/source3/utils/net_dns.c b/source3/utils/net_dns.c
index b94bef987a1..8275042f3e5 100644
--- a/source3/utils/net_dns.c
+++ b/source3/utils/net_dns.c
@@ -207,48 +207,4 @@ int get_my_ip_address( struct sockaddr_storage **pp_ss )
 	return count;
 }
 
-DNS_ERROR do_gethostbyname(const char *server, const char *host)
-{
-	struct dns_connection *conn = NULL;
-	struct dns_request *req, *resp;
-	DNS_ERROR err;
-	int ans = 0;
-
-	err = dns_open_connection(server, DNS_UDP, NULL, &conn);
-	if (!ERR_DNS_IS_OK(err)) {
-		goto error;
-	}
-
-	err = dns_create_query(conn, host, QTYPE_A, DNS_CLASS_IN, &req);
-	if (!ERR_DNS_IS_OK(err)) {
-		goto error;
-	}
-
-	err = dns_transaction(conn, conn, req, &resp);
-	if (!ERR_DNS_IS_OK(err)) {
-		goto error;
-	}
-
-	if (resp->num_answers == 0) {
-		printf("%s", "No answers!\n");
-		goto error;
-	}
-
-	for (ans = 0; ans < resp->num_answers; ans++) {
-		struct in_addr resp_ip;
-
-		if (ans > 0)
-			printf("%s", " ");
-
-		resp_ip.s_addr = *((uint32_t *)resp->answers[ans]->data);
-		printf("%s", inet_ntoa(resp_ip));
-	}
-
-	printf("%s", "\n");
-
- error:
-	TALLOC_FREE(conn);
-	return err;
-}
-
 #endif	/* defined(WITH_DNS_UPDATES) */
diff --git a/source3/utils/net_dns.h b/source3/utils/net_dns.h
index e44e93a2ddd..ef70fddd97c 100644
--- a/source3/utils/net_dns.h
+++ b/source3/utils/net_dns.h
@@ -38,6 +38,4 @@ DNS_ERROR DoDNSUpdate(char *pszServerName,
 		      size_t num_addrs,
 		      uint32_t flags, bool remove_host);
 
-DNS_ERROR do_gethostbyname(const char *server, const char *host);
-
 #endif /* defined(WITH_DNS_UPDATES) */
diff --git a/testprogs/blackbox/test_net_ads_dns.sh b/testprogs/blackbox/test_net_ads_dns.sh
index d3b1e7975c5..86566712194 100755
--- a/testprogs/blackbox/test_net_ads_dns.sh
+++ b/testprogs/blackbox/test_net_ads_dns.sh
@@ -45,6 +45,7 @@ UID_WRAPPER_ROOT=1
 export UID_WRAPPER_ROOT
 
 IPADDRESS=10.1.4.111
+IP6ADDRESS=fd00:1a1a::1:5ee:bad:c0de
 IPADDRMAC=10.1.4.124
 UNPRIVIP=10.1.4.130
 NAME=testname
@@ -56,17 +57,15 @@ UNPRIVPASS=UnPrivPass1
 # unprivileged users cannot do so.
 echo "Starting ..."
 
-testit "admin user should be able to add a DNS entry $NAME.$REALM $IPADDRESS" $VALGRIND $net_tool ads dns register $NAME.$REALM $IPADDRESS -U$DC_USERNAME%$DC_PASSWORD || failed=`expr $failed + 1`
+testit "admin user should be able to add a DNS entry $NAME.$REALM $IPADDRESS $IP6ADDRESS" $VALGRIND $net_tool ads dns register $NAME.$REALM $IPADDRESS $IP6ADDRESS -U$DC_USERNAME%$DC_PASSWORD || failed=`expr $failed + 1`
 
-# The complicated pipeline is to ensure that we remove exclamation points
-# and spaces from the output. Thew will screw up the comparison syntax.
-testit "We should be able to see the new name $NAME.$REALM" [ X"`$VALGRIND $net_tool ads dns gethostbyname $SERVER $NAME.$REALM -U$DC_USERNAME%$DC_PASSWORD | tr \! N | tr " " B`" = X"$IPADDRESS" ] || failed=`expr $failed + 1`
+testit "We should be able to see the new name $NAME.$REALM $IPADDRESS" dig @$SERVER +short -t a $NAME.$REALM | grep -q $IPADDRESS || failed=`expr $failed + 1`
+testit "We should be able to see the new name $NAME.$REALM $IP6ADDRESS" dig @$SERVER +short -t aaaa $NAME.$REALM | grep -q $IP6ADDRESS || failed=`expr $failed + 1`
 
-testit "We should be able to unregister the name $NAME.$REALM $IPADDRESS" $VALGRIND $net_tool ads dns unregister $NAME.$REALM -U$DC_USERNAME%$DC_PASSWORD || failed=`expr $failed + 1`
+testit "We should be able to unregister the name $NAME.$REALM" $VALGRIND $net_tool ads dns unregister $NAME.$REALM -U$DC_USERNAME%$DC_PASSWORD || failed=`expr $failed + 1`
 
-# The complicated pipeline is to ensure that we remove exclamation points
-# and spaces from the output. Thew will screw up the comparison syntax.
-testit "The name $NAME.$REALM should not be there any longer" test X"`$net_tool ads dns gethostbyname $SERVER $NAME.$REALM -U$DC_USERNAME%$DC_PASSWORD | tr " " B | tr \! N`" != X"$IPADDRESS" || failed=`expr $failed + 1`
+testit "The name $NAME.$REALM $IPADDRESS should not be there any longer" dig @$SERVER +short -t a $NAME.$REALM | grep -q $IPADDRESS && failed=`expr $failed + 1`
+testit "The name $NAME.$REALM $IP6ADDRESS should not be there any longer" dig @$SERVER +short -t aaaa $NAME.$REALM | grep -q $IP6ADDRESS && failed=`expr $failed + 1`
 
 # This should be an expect_failure test ...
 testit "Adding an unprivileged user" $VALGRIND $net_tool user add $UNPRIVUSER $UNPRIVPASS -U$DC_USERNAME%$DC_PASSWORD || failed=`expr $failed + 1`
@@ -86,17 +85,14 @@ testit "Unprivileged users should be able to add new names" $net_tool ads dns re
 # This should work as well
 testit "machine account should be able to add a DNS entry net ads dns register membername.$REALM $IPADDRMAC -P " $net_tool ads dns register membername.$REALM $IPADDRMAC -P || failed=`expr $failed + 1`
 
-# The complicated pipeline is to ensure that we remove exclamation points
-# and spaces from the output. Thew will screw up the comparison syntax.
-testit "We should be able to see the new name membername.$REALM using -P" [ X"`$VALGRIND $net_tool ads dns gethostbyname $SERVER membername.$REALM -P | tr \! N | tr " " B`" = X"$IPADDRMAC" ] || failed=`expr $failed + 1`
+testit "We should be able to see the new name membername.$REALM" dig @$SERVER +short -t a membername.$REALM | grep -q $IPADDRMAC || failed=`expr $failed + 1`
 
 #Unprivileged users should not be able to overwrite other's names
-testit_expect_failure "Unprivileged users should not be able modify existing names" $net_tool ads dns register membername.$REALM $UNPRIVIP -U$UNPRIVUSER%$UNPRIVPASS || failed=`expr $failed + 1`
+testit_expect_failure "Unprivileged users should not be able to modify existing names" $net_tool ads dns register membername.$REALM $UNPRIVIP -U$UNPRIVUSER%$UNPRIVPASS || failed=`expr $failed + 1`
 
 testit "We should be able to unregister the name $NAME.$REALM $IPADDRESS" $VALGRIND $net_tool ads dns unregister $NAME.$REALM -P || failed=`expr $failed + 1`
 
-# The complicated pipeline is to ensure that we remove exclamation points
-# and spaces from the output. Thew will screw up the comparison syntax.
-testit "The name $NAME.$REALM should not be there any longer" test X"`$net_tool ads dns gethostbyname $SERVER $NAME.$REALM -P | tr " " B | tr \! N`" != X"$IPADDRESS" || failed=`expr $failed + 1`
+testit "The name $NAME.$REALM ($IPADDRESS) should not be there any longer" dig @$SERVER +short -t a $NAME.$REALM | grep -q $IPADDRESS && failed=`expr $failed + 1`
+testit "The name $NAME.$REALM ($IP6ADDRESS) should not be there any longer" dig @$SERVER +short -t aaaa $NAME.$REALM | grep -q $IP6ADDRESS && failed=`expr $failed + 1`
 
 exit $failed
diff --git a/testprogs/blackbox/test_net_ads_dns_async.sh b/testprogs/blackbox/test_net_ads_dns_async.sh
index f0bd0835b4d..b993ab260bb 100755
--- a/testprogs/blackbox/test_net_ads_dns_async.sh
+++ b/testprogs/blackbox/test_net_ads_dns_async.sh
@@ -24,15 +24,18 @@ net_tool="$samba4bindir/net"
 echo "Starting ..."
 
 test_async_dns() {
-	#
-	# Do the gethostbyname request. This just prints the IPv4 addr.
-	#
-	cmd_sync='$net_tool ads dns gethostbyname $SERVER $SERVER.$REALM'
+	cmd_sync='dig @$SERVER +short -t a $SERVER.$REALM'
 	eval echo "$cmd_sync"
 	ipv4_sync=$(eval $cmd_sync)
 	if [ -z "$ipv4_sync" ]; then
 		return 1
 	fi
+	cmd_sync='dig @$SERVER +short -t aaaa $SERVER.$REALM'
+	eval echo "$cmd_sync"
+	ipv6_sync=$(eval $cmd_sync)
+	if [ -z "$ipv6_sync" ]; then
+		return 1
+	fi
 
 	#
 	# Do the async request. This prints out info like:
@@ -50,8 +53,9 @@ test_async_dns() {
 
 	# Drop everything but the IPv4 address.
 	ipv4_async=`echo "$out_async" | grep IPv4addr | sed -e 's/^.*IPv4addr = //'`
+	ipv6_async=`echo "$out_async" | grep IPv6addr | sed -e 's/^.*IPv6addr = //'`
 
-	if [ -z "$ipv4_async" ]; then
+	if [ -z "$ipv4_async" -o -z "$ipv6_async" ]; then
 		return 1
 	fi
 	if [ "$ipv4_sync" != "$ipv4_async" ]; then
@@ -59,6 +63,11 @@ test_async_dns() {
 		echo "DNS commands output. out1=$ipv4_sync, out2=$out_async"
 		return 1
 	fi
+	if [ "$ipv6_sync" != "$ipv6_async" ]; then
+		echo "DNS lookup mismatch. Sync $ipv6_sync, async $ipv6_async"
+		echo "DNS commands output. out1=$ipv6_sync, out2=$out_async"
+		return 1
+	fi
 	return 0
 }
 


-- 
Samba Shared Repository


From vlendec at samba.org  Wed Dec 30 10:22:01 2020
From: vlendec at samba.org (Volker Lendecke)
Date: Wed, 30 Dec 2020 10:22:01 +0000
Subject: [SCM] Samba Shared Repository - branch master updated
Message-ID: <E1kuYcD-00DvLS-AY@hrx0.samba.org>

The branch, master has been updated
       via  542ae1055cd vfs_gpfs:Logging filename for smbd_gpfs_set_times_path()
      from  8fcde5912a9 net: remove obsolete net ads dns gethostbyname command

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 542ae1055cd58c4715641b1665716b97efe371b3
Author: Archana <Archana.chidirala.chidirala at ibm.com>
Date:   Tue Dec 15 00:44:47 2020 +0530

    vfs_gpfs:Logging filename for smbd_gpfs_set_times_path()
    
    Signed-off-by: ArchanaChidirala <archana.chidirala.chidirala at ibm.com>
    Reviewed-by: Christof Schmitt <cs at samba.org>
    Reviewed-by: Volker Lendecke <vl at samba.org>
    
    Autobuild-User(master): Volker Lendecke <vl at samba.org>
    Autobuild-Date(master): Wed Dec 30 10:21:08 UTC 2020 on sn-devel-184

-----------------------------------------------------------------------

Summary of changes:
 source3/modules/vfs_gpfs.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)


Changeset truncated at 500 lines:

diff --git a/source3/modules/vfs_gpfs.c b/source3/modules/vfs_gpfs.c
index d7dec809c6e..172194dbead 100644
--- a/source3/modules/vfs_gpfs.c
+++ b/source3/modules/vfs_gpfs.c
@@ -1897,8 +1897,9 @@ static int smbd_gpfs_set_times_path(char *path, struct smb_file_time *ft)
 	rc = gpfswrap_set_times_path(path, flags, gpfs_times);
 
 	if (rc != 0 && errno != ENOSYS) {
-		DEBUG(1,("gpfs_set_times() returned with error %s\n",
-			strerror(errno)));
+		DBG_WARNING("gpfs_set_times() returned with error %s for %s\n",
+			    strerror(errno),
+			    path);
 	}
 
 	return rc;


-- 
Samba Shared Repository