1
0
mirror of https://github.com/samba-team/samba.git synced 2025-03-15 02:50:27 +03:00

111181 Commits

Author SHA1 Message Date
Amitay Isaacs
00a263982c ctdb-vacuum: Fix the incorrect counting of remote errors
If a node fails to delete a record in TRY_DELETE_RECORDS control during
vacuuming, then it's possible that other nodes also may fail to delete a
record.  So instead of deleting the record from RB tree on first failure,
keep track of the remote failures.

Update delete_list.remote_error and delete_list.left statistics only
once per record during the delete_record_traverse.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13641

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
(cherry picked from commit ef052397173522ac2dd0d0bd9660a18a13a3e4fc)
2018-10-09 11:29:25 +02:00
Amitay Isaacs
d08665ffa8 ctdb-vacuum: Simplify the deletion of vacuumed records
The 3-phase deletion of vacuumed records was introduced to overcome
the problem of record(s) resurrection during recovery.  This problem
is now handled by avoiding the records from recently INACTIVE nodes in
the recovery process.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13641

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
(cherry picked from commit 202b9027ba44eee33c2fde2332126be10f719423)
2018-10-09 11:29:25 +02:00
Martin Schwenke
7b5233003d ctdb-tests: Add recovery record resurrection test for volatile databases
Ensure that deleted records and vacuumed records are not resurrected
from recently inactive nodes.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13641

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
(cherry picked from commit dcc9935995a5a7b40df64653a605d1af89075bd1)
2018-10-09 11:29:25 +02:00
Amitay Isaacs
4b7d81955a ctdb-daemon: Invalidate records if a node becomes INACTIVE
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13641

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
(cherry picked from commit c4ec99b1d3f1c5bff83bf66e3fd64d45a8be7441)
2018-10-09 11:29:25 +02:00
Amitay Isaacs
ffc84e1c9a ctdb-daemon: Don't pull any records if records are invalidated
This avoids unnecessary work during recovery to pull records from nodes
that were INACTIVE just before the recovery.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13641

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
(cherry picked from commit 040401ca3abfa266261130f6c5ae4e9718f19cd7)
2018-10-09 11:29:25 +02:00
Amitay Isaacs
a363e0ce25 ctdb-daemon: Add invalid_records flag to ctdb_db_context
If a node becomes INACTIVE, then all the records in volatile databases
are invalidated.  This avoids the need to include records from such
nodes during subsequent recovery after the node comes out INACTIVE state.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13641

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
(cherry picked from commit 71896fddf10a92237d332779ccbb26c059caa649)
2018-10-09 11:29:25 +02:00
Jeremy Allison
ed962c85b1 s3: smbd: Prevent valgrind errors in smbtorture3 POSIX test.
Missing fsp talloc free and linked list delete in error
paths in close_directory(). Now matches close_normal_file()
and close_fake_file().

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13633

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Sat Sep 29 05:32:41 CEST 2018 on sn-devel-144

(cherry picked from commit 660dbfaeff493359474ebdb36098ac49b3f7ba0c)
2018-10-09 11:29:24 +02:00
Volker Lendecke
8d0fbe3ebb examples: Fix the smb2mount build
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13465

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit 94852e3544bf2cace3ddba8b9c89d986d77fdab5)
2018-10-09 11:29:24 +02:00
Christof Schmitt
79e60e59ea s3:smbget: Use cmdline_messaging_context
Initialize the messaging context through cmdline_messaging_context to
allow access to config in clustered Samba.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13465

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit 20ed13923ed3c55e1b293e5440028d29384e9d3a)
2018-10-09 11:29:24 +02:00
Christof Schmitt
4d9a78ca3d s3:smbcontrol: Use cmdline_messaging_context
Initialize the messaging context through cmdline_messaging_context to
allow access to config in clustered Samba.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13465

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit de040eafbd7d729316d757c14c44df163a4b36ad)
2018-10-09 11:29:24 +02:00
Christof Schmitt
6a0ae3b5f9 s3:dbwrap_tool: Use cmdline_messaging_context
Initialize the messaging context through cmdline_messaging_context to
allow access to config in clustered Samba.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13465

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit 7eeff96b826711b5a8d44ab24603dafcc0343d84)
2018-10-09 11:29:24 +02:00
Christof Schmitt
eea0c0d282 s3:eventlogadm: Use cmdline_messaging_context
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13465

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(backported from commit 095123df945270bc51635a19125a7abdfcd4ab80)
2018-10-09 11:29:24 +02:00
Christof Schmitt
c392f642ba s3: ntlm_auth: Use cmdline_messaging_context
Call cmdline_messaging_context to initialize the messaging context
before accessing clustered Samba config.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13465

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit 9ed617474f588ceb42c8929ee8a51071a408c219)
2018-10-09 11:29:24 +02:00
Christof Schmitt
7a7b33a3f7 s3:sharesec: Use cmdline_messaging_context
Call cmdline_messasging_context to initialize messaging context before
accessing clustered Samba config.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13465

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit cab8f27bbc927e48c52bac6350325e8ec38092b2)
2018-10-09 11:29:24 +02:00
Christof Schmitt
5b8f270611 s3:testparm: Use cmdline_messaging_context
Call cmdline_messaging_context to initialize a messaging config before
accessing clustered Samba config.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13465

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit ea7a4ff7ae5ef2b22fb7ef5640d6b946c064cfc3)
2018-10-09 11:29:24 +02:00
Christof Schmitt
1c4522db8f s3:pdbedit: Use cmdline_messaging_context
Initialize the messaging context through cmdline_messaging_context to
allow access to config in clustered Samba.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13465

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit 4661537c201acebee991d219d151cb481f56265c)
2018-10-09 11:29:23 +02:00
Ralph Boehme
18cd5c525e s3:messaging: remove unused messaging_init_client()
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13465

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Christof Schmitt <cs@samba.org>
(cherry picked from commit f56496b11469f0e9af9ba81cefb796ca1febabb1)
2018-10-09 11:29:23 +02:00
Christof Schmitt
bf4cd2a74c s3:net: Use cmdline_messaging_context
Use cmdline_messaging_context with its error checking instead of open
coding the same steps.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13465

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(backported from commit f2b659e4f518ccb06f221dd028f99883ca1a1847)
2018-10-09 11:29:23 +02:00
Christof Schmitt
12afd47edc rpcclient: Use cmdline_messaging_context
Use cmdline_messaging_context with its error checking instead of open
coding the same steps.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13465

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit dd3ae2ffdc66be4707471bfccf27ef446b5599cb)
2018-10-09 11:29:23 +02:00
Christof Schmitt
37d29db0bd s3:smbstatus: Use cmdline_messaging_context
Use cmdline_messaging_context to initialize a messaging context instead
of open coding the same steps.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13465

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(backported from commit d7fa3815a83a50fd9e3d78cac0d5ef3eb79235e5)
2018-10-09 11:29:23 +02:00
Christof Schmitt
4a89ab6ca4 s3:smbpasswd: Use cmdline_messaging_context
smbpasswd does not use POPT_CREDENTIALS. Call cmdline_messaging_context
to initialize a messaging_context with proper error checking before
calling lp_load_global.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13465

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit 29fd2c2e5ad3c2d44f3629c6b7b4139772fe350c)
2018-10-09 11:29:23 +02:00
Christof Schmitt
a1ba253642 test:doc: Skip 'clustering=yes'
As testparm will error out when running clustering=yes as non-root, skip
this step to avoid a test failure.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13465

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(backported from commit 3ecb9ed7b079fc1bf74c311cf5f1684086b36883)
2018-10-09 11:29:23 +02:00
Ralph Boehme
a12dd7322a s3:popt_common: use cmdline_messaging_context() in popt_common_credentials_callback()
This adds a call to cmdline_messaging_context() to the popt
popt_common_credentials_callback() hook and ensures that any client tool
that uses POPT_COMMON_CREDENTIALS gets an implicit messaging context,
ensuring it doesn't crash in the subsequent lp_load_client() with
include=registry in a cluster.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13465

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Christof Schmitt <cs@samba.org>
(cherry picked from commit 2c63ce94ef3a55ab0aa1aae4f6fee88e29ac2efe)
2018-10-09 11:29:23 +02:00
Ralph Boehme
265bfe242b selftest: pass configfile to pdbedit
This is needed otherwise pdbedit fails to initialize messaging in
autobuild.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13465

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Christof Schmitt <cs@samba.org>
(cherry picked from commit 10e1a6ebb3d95b8a1584a9b90c2584536aa9c96d)
2018-10-09 11:29:23 +02:00
Ralph Boehme
d8a68702a7 s3:loadparm: reinit_globals in lp_load_with_registry_shares()
This was set to false in 0e0d77519c27038b30fec92d542198e97be767d9 based
on the assumption that callers would have no need to call
lp_load_initial_only() with a later call to lp_load_something().

This is not quite correct, since for accessing registry config on a
cluster with include=registry, we need messaging up and running which
*itself* requires loadparm to be initialized to get the statedir,
lockdir asf. directories.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13465

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Christof Schmitt <cs@samba.org>
(cherry picked from commit 3aca3f24d4bdacc11278388934b0b411d518d7b0)
2018-10-09 11:29:22 +02:00
Christof Schmitt
4aace81949 s3:lib: Introduce cmdline context wrapper
Command line tools need acccess to the same messaging context provided
by server_messaging_context, as common code for db_open uses that
context. We want to have additional checking for command line tools
without having that code part of the servers. Introduce a wrapper
library to use for command line tools with the additional checks, that
then acquires the server_messaging_context.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13465

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit 8c3b62e6231e62feafacf2a7ee4c9d41cd27a4a1)
2018-10-09 11:29:22 +02:00
Christof Schmitt
050208f3b6 s3:lib: Move popt_common_credentials to separate file
This is only used by command line utilities and has additional
dependencies. Move to a separate file to contain the dependencies to the
command line tools.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13465

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit b7464fd89bc22b71c82bbaa424bcbfcf947db651)
2018-10-09 11:29:22 +02:00
Christof Schmitt
3c708d9e35 s3/lib:popt_common: Move setup_logging to common callback
The flag is set in the common callback, so be consistent

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13465

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit dff1028e8ba4c70e726283c12531853681034014)
2018-10-09 11:29:22 +02:00
Ralph Boehme
a81799cf62 s3:lib/server_contexts: make server_event_ctx and server_msg_ctx static
server_event_ctx and server_msg_ctx static shouldn't be accessible from
outside this compilation unit.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13465

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Christof Schmitt <cs@samba.org>
(cherry picked from commit d920a725ee19215190bbccaefd5b426bedc98860)
2018-10-09 11:29:22 +02:00
Karolin Seeger
03a6d361c2 VERSION: Disable GIT_SNAPSHOT for the 4.8.6 release.
Signed-off-by: Karolin Seeger <kseeger@samba.org>
samba-4.8.6
2018-10-08 11:25:32 +02:00
Karolin Seeger
a6f15a0dd6 VERSION: Bump version up to 4.8.6...
and re-enable GIT_SNAPSHOT.

Signed-off-by: Karolin Seeger <kseeger@samba.org>
2018-10-08 11:25:32 +02:00
Karolin Seeger
8b8b0dc61e WHATSNEW: Add release notes for Samba 4.8.6.
Signed-off-by: Karolin Seeger <kseeger@samba.org>
2018-10-08 11:25:32 +02:00
Volker Lendecke
0e25965676 lib: Hold at most 10 outstanding paged result cookies
Bug: https://bugzilla.samba.org/show_bug.cgi?id=13362
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue May 15 09:37:21 CEST 2018 on sn-devel-144

(cherry picked from commit 9fbd4672b06de5333a9c44fc126b8edac0b9d31a)

Autobuild-User(v4-8-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-8-test): Thu Sep 27 15:32:11 CEST 2018 on sn-devel-144
2018-09-27 15:32:11 +02:00
Volker Lendecke
aa529bc414 lib: Put "results_store" into a doubly linked list
Bug: https://bugzilla.samba.org/show_bug.cgi?id=13362
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 8063995a92fffc93aa9d6d1d92a75bf3f3c9592b)
2018-09-27 11:07:23 +02:00
Martin Schwenke
189697a98b ctdb-recoverd: Set recovery lock handle at start of attempt
This allows the attempt to be cancelled if an election is lost and an
unlock is done before the attempt is completed.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13617

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

Autobuild-User(master): Martin Schwenke <martins@samba.org>
Autobuild-Date(master): Tue Sep 18 02:18:30 CEST 2018 on sn-devel-144

(cherry picked from commit 486022ef8f43251258f255ffa15f1a01bc6aa2b7)

Autobuild-User(v4-8-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-8-test): Thu Sep 20 14:05:59 CEST 2018 on sn-devel-144
2018-09-20 14:05:59 +02:00
Martin Schwenke
21e4884a1a ctdb-recoverd: Handle cancellation when releasing recovery lock
If the recovery lock is in the process of being taken then free the
cluster mutex handle but leave the recovery lock handle in place.
This allows ctdb_recovery_lock() to fail.

Note that this isn't yet live because rec->recovery_lock_handle is
still only set at the completion of the attempt to take the lock.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13617

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
(cherry picked from commit b1dc5687844e90b0e3c39cb46a1116c86118fbf4)
2018-09-20 09:13:12 +02:00
Martin Schwenke
da9bb48a45 ctdb-recoverd: Return early when the recovery lock is not held
This makes upcoming changes simpler.

Update to modern debug macro while touching relevant line.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13617

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
(cherry picked from commit a755d060c13b65dfb6d73979aaf111c489882bfb)
2018-09-20 09:13:12 +02:00
Martin Schwenke
72a8c69935 ctdb-recoverd: Store recovery lock handle
... not just cluster mutex handle.

This makes the recovery lock handle long-lived and with allow the
releasing code to cancel an in-progress attempt to take the recovery
lock.

The cluster mutex handle is now allocated off the recovery lock
handle.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13617

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
(cherry picked from commit c52216740bd81b68876de06e104822bbbca86df9)
2018-09-20 09:13:12 +02:00
Martin Schwenke
9745524234 ctdb-recoverd: Use talloc() to allocate recovery lock handle
At the moment this is still local and is freed after the mutex is
successfully taken.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13617

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
(cherry picked from commit a53b264aee7d620ee8ecf9114b0014c5bb678484)
2018-09-20 09:13:12 +02:00
Martin Schwenke
a4c438601a ctdb-recoverd: Rename hold_reclock_state to ctdb_recovery_lock_handle
This will be a longer lived structure.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13617

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
(cherry picked from commit af22f03dbe9040f5f743eb85bb50d411269bbab4)
2018-09-20 09:13:12 +02:00
Martin Schwenke
9b1cc7afee ctdb-recoverd: Re-check master on failure to take recovery lock
If the master changed while trying to take the lock then fail gracefully.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13617

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
(cherry picked from commit c516e58ce92c420dc993bd9b7f1433641bd764bd)
2018-09-20 09:13:12 +02:00
Martin Schwenke
43c1ad1537 ctdb-recoverd: Clean up taking of recovery lock
No functional changes, just coding style cleanups and debug message
tweaks.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13617

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
(cherry picked from commit 59fc01646c7d65ba90b0a1a34c3795ff842351c5)
2018-09-20 09:13:11 +02:00
Martin Schwenke
eb498ec2ba ctdb-cluster-mutex: Block signals around fork
If SIGTERM is received and the tevent signal handler setup in the
recovery daemon is still enabled then the signal is handled and a
corresponding event is queued.  The child never runs an event loop so
the signal is effectively ignored.

Resetting the SIGTERM handler isn't enough.  A signal can arrive
before that.

Block SIGTERM before forking and then immediately unblock it in the
parent.

In the child, unblock SIGTERM after the signal handler is reset.  An
explicit unblock is needed because according to sigprocmask(2) "the
signal mask is preserved across execve(2)".

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13617

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
(cherry picked from commit e789d0da57fc3fc6d22bfa00577a2e65034ca27a)
2018-09-20 09:13:11 +02:00
Martin Schwenke
1954a94203 ctdb-cluster-mutex: Reset SIGTERM handler in cluster mutex child
If SIGTERM is received and the tevent signal handler setup in the
recovery daemon is still enabled then the signal is handled and a
corresponding event is queued.  The child never runs an event loop so
the signal is effectively ignored.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13617

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
(cherry picked from commit 5a6b139884f08ee2ee10f9d16fe56ad8fb5352a6)
2018-09-20 09:13:11 +02:00
Andreas Schneider
b29d90ffa4 wafsamba: Fix 'make -j<jobs>'
Currently only 'make -j' enables parallel builds and e.g. 'make -j4'
results in no parallel compile jobs at all.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13606

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Fri Sep  7 20:24:46 CEST 2018 on sn-devel-144

(cherry picked from commit 70169d4789fe8b2ee4efe5e88eeaa80e1a641b32)

Autobuild-User(v4-8-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-8-test): Mon Sep 10 16:45:04 CEST 2018 on sn-devel-144
2018-09-10 16:45:04 +02:00
Alexander Bokovoy
3ea96a2592 krb5-samba: interdomain trust uses different salt principal
Salt principal for the interdomain trust is krbtgt/DOMAIN@REALM where
DOMAIN is the sAMAccountName without the dollar sign ($)

The salt principal for the BLA$ user object was generated wrong.

dn: CN=bla.base,CN=System,DC=w4edom-l4,DC=base
securityIdentifier: S-1-5-21-4053568372-2049667917-3384589010
trustDirection: 3
trustPartner: bla.base
trustPosixOffset: -2147483648
trustType: 2
trustAttributes: 8
flatName: BLA

dn: CN=BLA$,CN=Users,DC=w4edom-l4,DC=base
userAccountControl: 2080
primaryGroupID: 513
objectSid: S-1-5-21-278041429-3399921908-1452754838-1597
accountExpires: 9223372036854775807
sAMAccountName: BLA$
sAMAccountType: 805306370
pwdLastSet: 131485652467995000

The salt stored by Windows in the package_PrimaryKerberosBlob
(within supplementalCredentials) seems to be
'W4EDOM-L4.BASEkrbtgtBLA' for the above trust
and Samba stores 'W4EDOM-L4.BASEBLA$'.

While the salt used when building the keys from
trustAuthOutgoing/trustAuthIncoming is
'W4EDOM-L4.BASEkrbtgtBLA.BASE', which we handle correct.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13539

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Alexander Bokovoy <ab@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Sep  5 03:57:22 CEST 2018 on sn-devel-144

(cherry picked from commit f3e349bebc443133fdbe4e14b148ca8db8237060)

Autobuild-User(v4-8-test): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(v4-8-test): Wed Sep  5 18:32:05 CEST 2018 on sn-devel-144
2018-09-05 18:32:04 +02:00
Stefan Metzmacher
d726535d61 testprogs/blackbox: let test_trust_user_account.sh check the correct kerberos salt
This demonstrates the bug we currently have.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13539

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit 1b31fa62567ec549e32c9177b322cfbfb3b6ec1a)
2018-09-05 13:31:46 +02:00
Stefan Metzmacher
04fee9ebee testprogs/blackbox: add testit[_expect_failure]_grep() to subunit.sh
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13539

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit 8526feb100e59bc5a15ceb940e6cecce0de59247)
2018-09-05 13:31:46 +02:00
Stefan Metzmacher
e311e6e807 samba-tool: add virtualKerberosSalt attribute to 'user getpassword/syncpasswords'
This might be useful for someone, but at least it's very useful for
tests.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13539

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit 39c281a23673691bab621de1a632d64df2c1c102)
2018-09-05 13:31:45 +02:00
Alexander Bokovoy
0534104e0b s4:selftest: test kinit with the interdomain trust user account
To test it, add a blackbox test that ensures we pass a keytab-based
authentication with the trust user account for a trusted domain.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13539

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Alexander Bokovoy <ab@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit 7df505298f71432d5adbcffccde8f97c117a57a6)
2018-09-05 13:31:45 +02:00