Re: [Samba] Samba 3.6 directory ACLs

2010-10-18 Thread Miguel Medalha



I had not realized that the ACL module would store both sets of information.


Please note that I *didn't* state that. What I said is that you can use 
Extended Attributes to *also* store ACL information. ACL information 
will be stored under a different attribute, which in this case is called 
security.NTACL.


Most Samba VFS modules are stackable.

--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba


Re: [Samba] Samba 3.6 directory ACLs

2010-10-18 Thread Miguel Medalha



While testing my Samba configuration, I found that permissions are being set
to 'special' for directories being copied from Windows instead of the ACL
being fully populated.  Does Samba 3.6 fully implement ACLS, or are there
further configuration steps for storing the ACL information for directories


Of course you are aware that the normal Windows behavior, which Samba 
emulates, is to keep ACLs when files are *moved* and modify them 
according to those of the destination when files are *copied*?


--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba


Re: [Samba] Procedure number out of range

2010-10-18 Thread Lars Andersson
 
 It seems that Samba in this version is sensitive to local characters in 
 passwd or tdb files (swedish in 
this case). In Samba 3.2.5 this wasn't an issue AFAIK.

Do you have the appropriate charset parameters for Swedish?

No, I haven't specified a character set. Just been using default probably 
UTF-8. It's been working without problems in 3.2.5.

Lars
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba


[Samba] Does not belong to our domain - messages

2010-10-18 Thread Wojciech Giel
Hello,
I have samba 3.4.8 sernet PDC and BDC with ldap backend on debian lenny. I
have joined a while ago two samba member server on opensolaris (3.0.37 and
3.0.34). Everything worked fine even now is working but from last week after
reboot of both samba members in winbind logs appear these messages after
invoking wbinfo -u:

# wbinfo -u
root
nobody
daniel
wojciech
chris
jan
...


# tail /varlog/samba/winbind.log

[2010/10/18 09:53:25, 0] passdb/pdb_ldap.c:(4216)
  sid S-1-5-21-2622244236-1008294448-3155893552-101348 does not belong to
our domain
[2010/10/18 09:53:25, 0] passdb/pdb_ldap.c:(4216)
  sid S-1-5-21-2622244236-1008294448-3155893552-103006 does not belong to
our domain
[2010/10/18 09:53:25, 0] passdb/pdb_ldap.c:(4216)
  sid S-1-5-21-2622244236-1008294448-3155893552-103004 does not belong to
our domain

What might be a problem?

thanks in advance.


My member server smb.conf
[global]

workgroup = TEST
netbios name = THOR
server string = Samba Member Server v.%v
enable privileges = yes
username map = /etc/sfw/smbusers
name resolve order = wins hosts bcast
dns proxy = yes

log file = /var/log/samba/%m.log
max log size = 50
syslog = 0
log level = 1
utmp = Yes

security = domain
encrypt passwords = true

interfaces = aggr0, lo
keep alive = 60
wins server = 192.168.1.3
winbind trusted domains only = yes

allow trusted domains = yes

passdb backend = ldapsam:ldap://ravenfield.test.local
ldap://ravenhill.test.local;
ldap suffix = dc=dil,dc=edu
ldap user suffix = ou=People
ldap group suffix = ou=Groups
ldap machine suffix = ou=Computers
ldap idmap suffix = ou=Idmap
ldap admin dn = uid=samba,ou=DSA,dc=dil,dc=edu
idmap backend = ldap:ldap://ravenfield.test.local
ldap://ravenhill.test.local;
idmap uid = 1-2
idmap gid = 1-2

acl check permissions = false
map read only = yes
map archive = no
map system = no
nt acl support = true
create mask = 0700
directory mask = 0700

unix charset = LOCALE
display charset = LOCALE

[homes]
comment = Home Directories
path = /home/%U
read only = no
browsable = no
hide files = /*.ini/
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba


Re: [Samba] samba 4 idmap problem

2010-10-18 Thread Kai Blin
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

On 2010-10-06 17:35, Taylor, Jonn wrote:
  Seems that each system is making up it own id's. Both the centos and
 fedora systems have the same idmap settings.
 
idmap uid = 300-400
idmap gid = 300-400

That means you're not setting an idmap backend, so this defaults to
tdb on the 3.5 boxes. In turn, this means that all three systems are
creating id mappings on an as-needed basis, creating uids and gids in
the order of the users/groups that request ids.

Unless you use some scheme that keeps the unixids in sync across the
network, you'll always be seeing this. Possible solutions include using
the rid backend to idmap, which will add the sid's RID part to the
idmap base. If you only have users coming in from one domain, that
should be fine for the 3.5 boxes.

The Samba4 idmap implementation is less sophisticated and only knows
about the tdb-like counting up unixids. Nothing much that can be done
about this right now. We're currently investigating the most viable way
to fix this.

Cheers,
Kai

- -- 
Kai Blin
Worldforge developer http://www.worldforge.org/
Wine developer http://wiki.winehq.org/KaiBlin
Samba team member http://www.samba.org/samba/team/
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAkytXbgACgkQEKXX/bF2FpQ1YACdG4f1GRHoWzarY8W5Xw2TEh96
O00An1YSpVBmRzYCePySJHZr0xdw3ua8
=0Bmi
-END PGP SIGNATURE-
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba


Re: [Samba] Broken support for Smart Card Logon in Windows 2003 and XP

2010-10-18 Thread Love Hörnquist Åstrand

6 okt 2010 kl. 02:49 skrev Michael Wood:

 hx509_cms_create_signed function and
 make sigctx.cmsidflag always equal CMS_ID_NAME)

I think this failed because you are looking at enveloped data and not signed 
data. try patching fill_CMSIdentifier() in hx509_cms_envelope_1() instead.

Love


-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

[Samba] Samba 4 in production?

2010-10-18 Thread Mark Rutherford
 I have read many stories and testimonials from people that are running 
Samba 4 in production.
This encouraged me to try it out in a couple of virtual machines and, as 
expected I encountered no problems that

I could not overcome. (mostly DNS setup issues)

We are running 3.5 right now just as a plain NT4 domain controller with 
DRBD and friends.
This setup has worked for many, many years and the possibility of 
gaining AD is very appealing.


When I tested Samba 4, I joined a few Samba 3 servers to it and used 
resources from those servers without any issues.

How are others using it in production?
Any pitfalls to using Samba 4 in this manner?
Anyone care to share their stories, good or bad?

Thanks everyone.


--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba


[Samba] Samba 4 Bad password lockout

2010-10-18 Thread Dave Thurston
I have a question about bad password lockout. 

Net pwsettings has settings for Complexity, Password history Length, Minimum 
password length, Minimum password age, and Maximum password age. 

But I can not see how to set a bad password login attempts. 

Can this be set using a group profile? 

Getting ready to use samba 4 for authentication purposes but really do need 
this ability. 
Everything else has tested out great. 


Thanks All. 


Dave 
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba


[Samba] SAMBA 4 ACL support

2010-10-18 Thread Vaclav Klecanda
Hi all,
I am experimenting with samba 4. I have existing data on NTFS partition and
want to share them via samba. But I have problems with permissions (ACL).
There is an option: ntvfs handler that tells how mapping of permissions
between unix and windows world shall behave. But there is lack of
documentation. So I tried posix, simiple but in either case I wasnot able to
write even set permissions via GUI from windows client. So I would like to
ask if somebody knows where could I read something about this topic or if
there is a guru that knows how this thing work, please could you share you
knowledge?

Thanks a lot, Vasek
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba


[Samba] Samba - Rejecting auth request debug log

2010-10-18 Thread Martin Hochreiter

 Hi there!

I set up a test enviroment and did a log level 256 of a domain user log on
with a Samba 3.5.5 and a windows 7 machine to deliver more data for that

  _netr_ServerAuthenticate3: netlogon_creds_server_check failed. 
Rejecting auth request from client TESTPC1 machine account TESTPC1$


problem.

Please find the logs enclosed (if a ~300kb rar log file is allowed here)
and maybe somebody can have a look at it and elighten us.

thanks
Martin


-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

[Samba] Samba 3.5.6 - configure creates Makefile with errors on Solaris 10

2010-10-18 Thread Robert M. Martel - CSU

Greetings,

Attempting to build samba 3.5.6 on Solaris 10.  Running make after the 
configure process has completed yields:


make: Fatal error in reader: Makefile, line 1396: Extra `:', `::', or 
`:=' on dependency line


Not that I have not had issues of late building Samba, but this id the 
first time it went of the rails so early in  the building process.


-Bob


--
***
Robert M. Martel I met someone who looks a lot like you
System Administrator She does the things you do
Levin College of Urban Affairs   But she is an IBM
Cleveland State University   -Jeff Lynne
(216) 687-2214
r.mar...@csuohio.edu
***
--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba


[Samba] Unable to compile Samba 3.5.6 on Solaris 9 - more winbind issues

2010-10-18 Thread Robert M. Martel - CSU

Greetings,

No helpful hints have been offered to my winbind issues with Samba 3.4.9 
and Solaris 9 I started trying to build Samba 3.5.6.  Using gcc 3.4.6. 
I added -lintl to the LIBS option in the Makefile which cleared some 
earlier linker errors involving libintl_gettext, libintl_textdomain  and 
libintl_bindtextdomain being undefined, except with winbind:


Linking shared library bin/pam_winbind.so
Undefined   first referenced
 symbol in file
libintl_bindtextdomain  ../nsswitch/pam_winbind.o
libintl_dgettext../nsswitch/pam_winbind.o
ld: fatal: Symbol referencing errors. No output written to 
bin/pam_winbind.so

collect2: ld returned 1 exit status
make: *** [bin/pam_winbind.so] Error 1

I have not been able to get any version of Samba beyond 3.2.15 to build 
on Solaris 9 with support for Active Directory.  Any later 3.2 version I 
see run-time errors with winbind which is why I decided to give 3.5 a try.


--
***
Robert M. MartelPushing myself and this old machine
System AdministratorBurning fumes
Levin College of Urban Affairs  and what's left of my dreams
Cleveland State University
(216) 687-2214
r.mar...@csuohio.edu
***
--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba


[Samba] Guest shares in an ADS security model

2010-10-18 Thread Madhusudan Singh
Are these possible ?

I am trying to setup a guest access printer attached to a working fileserver
that authenticates its users against a Windows AD. I keep getting
authentication requests on attempting to connect to the printer.

Before I post my smb.conf, I need to know if what I am trying to do is even
possible,

Thanks.
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba


Re: [Samba] Samba 3.6 directory ACLs

2010-10-18 Thread Jeremy Allison
On Sun, Oct 17, 2010 at 04:04:29AM -0700, Derek Lewis wrote:
 I have ACLs working for files with the following set in my share
 definitions:
 
 inherit permissions = yes
 
 inherit acls=yes
 
 map acl inherit=yes
 
 vfs_objects = acl_tdb
 
  
 
 While testing my Samba configuration, I found that permissions are being set
 to 'special' for directories being copied from Windows instead of the ACL
 being fully populated.  Does Samba 3.6 fully implement ACLS, or are there
 further configuration steps for storing the ACL information for directories?

FYI. I've just committed a jumbo ACL patch for v3-6-test (and am currently
looking at backporting this to 3.5.x) which I hope will fix several issues
with storing ACLs in xattrs and getting full Windows ACL compatibility.

I'll ping the lists when I want wider testing (still ensuring it all
works at the moment).

Cheers,

Jeremy.
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba


Re: [Samba] Samba 3.5.6 - configure creates Makefile with errors on Solaris 10

2010-10-18 Thread Gaiseric Vandal
Have you tried the precompiled samba version from sunfreeware.com?  It 
is only 3.4.2 but should have AD support. It won't have ZFS support 
(an issue for Solaris 10 but Solaris 9.)



the winbind nsswitch stuff may be require a little work to setup.


On 10/18/2010 10:05 AM, Robert M. Martel - CSU wrote:

Greetings,

Attempting to build samba 3.5.6 on Solaris 10.  Running make after the 
configure process has completed yields:


make: Fatal error in reader: Makefile, line 1396: Extra `:', `::', or 
`:=' on dependency line


Not that I have not had issues of late building Samba, but this id the 
first time it went of the rails so early in  the building process.


-Bob




--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba


Re: [Samba] Unable to compile Samba 3.5.6 on Solaris 9 - more winbind issues

2010-10-18 Thread Gaiseric Vandal
I had a lot of trouble with compiling Samba on Solaris 10.(Thumbs 
down to Sun for abandoning Samba.)


The ld command was a problem.Sunfreeware gcc is hard coded to use 
/usr/ccs/bin/ld.  I had set up a symlink so that /usr/ccs/bin/ld 
actually pointed to gld (e.g. /usr/sfw/bin/gld or /usr/local/bin/ld.)  .e.g

#cd /usr/ccs/bin
# mv ld ld.sun
# ln -s /usr/local/bin/ld /usr/ccs/bin/ld

You also have to make sure you have openldap installed and set CPPFLAGS  
and LDFLAGS in addition to PATH and LD_LIBRARY_PATH


e.g.

CPPFLAGS=-I /usr/local/samba-3.5.2/include
CPPFLAGS=-I /usr/sfw/include /usr/ccs/include $CPPFLAGS

LDFLAGS=-L/usr/local/samba-3.5.2/lib -R/usr/local/samba-3.5.2/lib
LDFLAGS=-L/usr/ccs/lib -R/usr/ccs/lib $LDFLAGS
LDFLAGS=-L/usr/sfw/lib -R/usr/sfw/lib $LDFLAGS


(maybe I already replied about this to an earlier post.)


It you get samba from sunfreeware.com, you may be able to compile the 
zfs module separately from source.  not sure.





On 10/18/2010 10:01 AM, Robert M. Martel - CSU wrote:



Greetings,

No helpful hints have been offered to my winbind issues with Samba 
3.4.9 and Solaris 9 I started trying to build Samba 3.5.6.  Using gcc 
3.4.6. I added -lintl to the LIBS option in the Makefile which 
cleared some earlier linker errors involving libintl_gettext, 
libintl_textdomain  and libintl_bindtextdomain being undefined, except 
with winbind:


Linking shared library bin/pam_winbind.so
Undefined   first referenced
 symbol in file
libintl_bindtextdomain  ../nsswitch/pam_winbind.o
libintl_dgettext../nsswitch/pam_winbind.o
ld: fatal: Symbol referencing errors. No output written to 
bin/pam_winbind.so

collect2: ld returned 1 exit status
make: *** [bin/pam_winbind.so] Error 1

I have not been able to get any version of Samba beyond 3.2.15 to 
build on Solaris 9 with support for Active Directory.  Any later 3.2 
version I see run-time errors with winbind which is why I decided to 
give 3.5 a try.




--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba


Re: [Samba] winbindd completely stopped responding

2010-10-18 Thread Gaiseric Vandal
idmap and winbind may be caching the entries (use testparm -v to look 
for cache or timeout values.)   windbind or idmap processes may load 
data when they start, cache it, but when the cache expires  they DON'T 
reload the data.


Just a guest.  I had this problem with samba 3.0.x but not 3.4.x.

On 10/18/2010 12:31 AM, Christian Huldt wrote:

I have a samba3 server (ubuntu, 3.4.7) joined to a samba4 that has been working 
very nicely but today I got errors:

net ads testjoin
says the join is OK, but
wbinfo -t

says
checking the trust secret via RPC calls failed
Could not check secret


and winbind logs on that machine (samba3) says:
lsa_lookupsids call failed with NT_STATUS_NO_MEMORY - retrying...

However, another samba3 machine that not really used works just fine...

I finally found two stuck winbind processes on the failing samba3 machine, 
after killing them and restarting winbind
everthing was working perfectly again, but I would like to understand the 
problem better.

What would cause winbindd to completely stop responding after running just fine 
for days?

Christian Huldt

   


--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba


Re: [Samba] Samba 3.5.6 - configure creates Makefile with errors on Solaris 10

2010-10-18 Thread Joe Cammisa
i've had no problem compiling up to 3.4.8 on several solaris10 boxes at
varying patch levels; but for some reason i can't get anywhere with 3.5.x.
has anyone else been successful in this regard?  any tips
appreciated--thanks all in advance...

-joe

On Mon, Oct 18, 2010 at 2:13 PM, Gaiseric Vandal
gaiseric.van...@gmail.comwrote:

 Have you tried the precompiled samba version from sunfreeware.com?  It is
 only 3.4.2 but should have AD support. It won't have ZFS support (an
 issue for Solaris 10 but Solaris 9.)


 the winbind nsswitch stuff may be require a little work to setup.


 On 10/18/2010 10:05 AM, Robert M. Martel - CSU wrote:

 Greetings,

 Attempting to build samba 3.5.6 on Solaris 10.  Running make after the
 configure process has completed yields:

 make: Fatal error in reader: Makefile, line 1396: Extra `:', `::', or `:='
 on dependency line

 Not that I have not had issues of late building Samba, but this id the
 first time it went of the rails so early in  the building process.

 -Bob



 --
 To unsubscribe from this list go to the following URL and read the
 instructions:  https://lists.samba.org/mailman/options/samba

-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba


[Samba] Problem with Winbindd

2010-10-18 Thread Bruno Steven
I have Openfiler box, I am trying integrated base user with Active directory
. When start service winbindd show this message

The log winbindd

tail -n 10 /var/log/samba/winbindd.log
[2010/10/18 16:07:05,  0] winbindd/winbindd_util.c:init_domain_list(736)
  Could not fetch our SID - did we join?
[2010/10/18 16:07:05,  0] winbindd/winbindd.c:main(1274)
  unable to initialize domain list
[2010/10/18 16:19:57,  0]
winbindd/winbindd_cache.c:initialize_winbindd_cache(2374)
  initialize_winbindd_cache: clearing cache and re-creating with version
number 1
[2010/10/18 16:19:57,  0] winbindd/winbindd_util.c:init_domain_list(736)
  Could not fetch our SID - did we join?
[2010/10/18 16:19:57,  0] winbindd/winbindd.c:main(1274)
  unable to initialize domain list

I have tried a lot forms for integration but nothing works !!!

Please somebody can explain for me this message ?

Thank very much .

-- 
Bruno Steven - Administrador de sistemas.

*CompTIA Security+  - Code: JYN7BD9BJGRECFM8
*



*LPIC-1 - LPI ID: lpi000119659 / Code: p2e4wz47e4
*

*MCP-Windows 2003 - TranscriptID: 793804 / Access Code: 080089100
*
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba


Re: [Samba] Samba 3.6 directory ACLs

2010-10-18 Thread Miguel Medalha



FYI. I've just committed a jumbo ACL patch for v3-6-test (and am currently
looking at backporting this to 3.5.x) which I hope will fix several issues
with storing ACLs in xattrs and getting full Windows ACL compatibility.


That would be *very* nice, especially the backporting to 3.5.x part!

Thank you!

(By the way: is there some tool that can manage the ACLs stored in 
Extended Attributes from the Linux command line? That would give us the 
best of both worlds: Windows compatibility and ACL setting from the 
server side. I know it is possible to use getfattr/setfattr but this 
is not very friendly, is it?  Also, a module providing those ACLs to 
Linux so that, for example, SSH or FTP could use them, would be very 
interesting. Am I asking too much or is this in some way irrelevant?)

--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba


[Samba] Setting up Samba4 - lots of implementation questions esp re. PKI and SSO

2010-10-18 Thread Paul Bradley
I have a LOT of questions!!! This may take a while. I know some of this
stuff is at the edge of what Samba4 is just becoming able to do, so if
anyone who knows feels this is better posted on samba-technical I'd
appreciate a cross-post from someone in a position to know for sure - I did
consider posting it there straight away but I figured it's a dev list and I
could at least get _some_ of my questions answered here first maybe.

I am setting up Samba4 for SSO on a home lan with VPN access. My needs are
therefore relatively modest in terms of the more enterprise level features
of S4 (awesome stuff by the way guys - what a project), but I do want to do
some stuff like use a PKI structure with smartcards, manage group policy for
the windows clients, use kerberos for single sign on and that sort of thing.
We have a few PCs/Laptops/VMs and are setting up a VPN, so although it's not
really enterprise level stuff I am doing a few things that are business
like if you want to put it that way. I have mainly windows clients (Win7,
WinXP VMs) but there are one or two linux VMs that I'd also like to get the
benefits of samba4 with. I'm strongly getting the impression from reading
over the past couple of days that samba4 has just recently reached the point
of doing basically everything I need.

Servers are linux and linux-like, applications are filesharing, ssh, vpn
(probably going to be IPSEC/L2TP - haven't set that up yet, it's waiting on
the PKI, and on the kerberos for authenticating sessions to services once
the VPN connection is made), apache for a Joomla CMS and probably a couple
of other bits and pieces that I've forgotten all about.

My questions are:


- I am a little confused about the PKI implementation. Especially as regards
the particular details of how I should set up the X509 information in the
certificates. I found this:
http://middleware.internet2.edu/pki07/proceedings/slides/10-kornievskaia-pkinit-interop.pdfwhich
seems quite detailed and covers quite a bit, in particular it mentions
this:

---QUOTE--
CLIENT IDENTITY
- Kerberos principal name encoded in X509 SAN
- Mapping facility at the KDC
- Must have X509 EKU fields
/QUOTE--

So to handle those one at a time, principal name for a user would just be
their username on the domain, or would it be the full CN like
p...@mydomain.com ?
Then for a service (I've read
http://technet.microsoft.com/en-us/library/cc961723.aspx) is the principal
name something like smb/192.168.0.1/:139/fileserver which would specify a
smb service on 192.168.0.1 on port 139 called fileserver, then fileserver
would be the name that resolved to 192.168.0.1 in the DNS? What happens with
multiple services on one server - do they all need separate keys and
certificates since they each need a different service principal name?
Perhaps it is enough to have more than one certificate each specifying a
different SPN, but all using the same key, or if I did that would there be a
security implication, since this might mean one service could masquerade as
another? How do I specify when creating the certificates with OpenSSL what
the SAN should be?

As to the second part - Mapping facility at the KDC. I understand the KDC
needs to map the user certificate onto a username on the domain (or perhaps
more accurately some sort of GUID for the user) but how is this set up when
using PKI - do I use the Microsoft domain administration tools to connect to
Samba and bind the user certificates to the users? What about servers -
presumably their keys (now stored on disk rather than on tokens/smartcards)
also need to be in the directory so they can be mapped to the object in the
directory and participate in the kerberos or indeed do PKINIT for eg. cron
jobs which require connecting to other services?

For the third part (X509 EKU fields) - are these the key usage fields? The
stuff like signing encryption etc. etc.? How do I set these in OpenSSL
when creating the certificates and what should I set them too?

Also, is there much in particular I should be aware of when creating my CA?
LDAP and X509 are probably my weakest points in understanding all this - can
someone point me to a guide or give me some more information that can guide
me in deciding how to name and structure things so as to avoid potential
future issues.




Now, as to the PKINIT I presume Samba4 will interact well enough with the
native Windows PKINIT so I shouldn't have much to worry about there, but
please do correct me if I'm wrong. What about the linux clients though -
should I use CITI PKINIT ? If I do, what will happen as regards the PKCS#11
library? I have two different types of cards here, both of which seem to
work OK with the commercial middleware and tools which I have (SafeSign,
which works on both Windows and Linux) so I would want to use the SafeSign
PKCS#11 libraries, presumably the PKINIT will talk to 

Build status as of Mon Oct 18 06:00:01 2010

2010-10-18 Thread build
URL: http://build.samba.org/

--- /home/build/master/cache/broken_results.txt.old 2010-10-17 
00:00:09.0 -0600
+++ /home/build/master/cache/broken_results.txt 2010-10-18 00:00:03.0 
-0600
@@ -1,4 +1,4 @@
-Build status as of Sun Oct 17 06:00:06 2010
+Build status as of Mon Oct 18 06:00:01 2010
 
 Build counts:
 Tree Total  Broken Panic 
@@ -16,7 +16,7 @@
 samba_3_current 32 32 5 
 samba_3_master 32 24 0 
 samba_3_next 32 31 0 
-samba_4_0_test 36 32 0 
+samba_4_0_test 36 31 0 
 talloc   32 8  0 
 tdb  30 11 0 
 


[SCM] Samba Shared Repository - branch v3-6-test updated

2010-10-18 Thread Volker Lendecke
The branch, v3-6-test has been updated
   via  1fec543 This is typo fix patch for smbcacls.1.xml .
  from  a733f2e7 Fix double ;; end-of-lines added in error.

http://gitweb.samba.org/?p=samba.git;a=shortlog;h=v3-6-test


- Log -
commit 1fec543a981d5e1716efc76e27ab5523e5efd06b
Author: Samba-JP oota rib...@samba.gr.jp
Date:   Mon Oct 18 07:10:29 2010 +0200

This is typo fix patch for smbcacls.1.xml .

Autobuild-User: Volker Lendecke vlen...@samba.org
Autobuild-Date: Mon Oct 18 05:53:26 UTC 2010 on sn-devel-104

---

Summary of changes:
 docs-xml/manpages-3/smbcacls.1.xml |   12 ++--
 1 files changed, 6 insertions(+), 6 deletions(-)


Changeset truncated at 500 lines:

diff --git a/docs-xml/manpages-3/smbcacls.1.xml 
b/docs-xml/manpages-3/smbcacls.1.xml
index 571cb69..756000a 100644
--- a/docs-xml/manpages-3/smbcacls.1.xml
+++ b/docs-xml/manpages-3/smbcacls.1.xml
@@ -21,12 +21,12 @@
commandsmbcacls/command
arg choice=req//server/share/arg
arg choice=reqfilename/arg
-   arg choice=opt-D acls/arg
-   arg choice=opt-M acls/arg
-   arg choice=opt-a acls/arg
-   arg choice=opt-S acls/arg
-   arg choice=opt-C name/arg
-   arg choice=opt-G name/arg
+   arg choice=opt-D|--delete acls/arg
+   arg choice=opt-M|--modify acls/arg
+   arg choice=opt-a|--add acls/arg
+   arg choice=opt-S|--set acls/arg
+   arg choice=opt-C|--chown name/arg
+   arg choice=opt-G|--chgrp name/arg
arg choice=opt-I allow|romove|copy/arg
arg choice=opt--numeric/arg
arg choice=opt-t/arg


-- 
Samba Shared Repository


[SCM] Samba Shared Repository - branch master updated

2010-10-18 Thread Jelmer Vernooij
The branch, master has been updated
   via  d1ca35c heimdal_build: Add dependency on com_err to HEIMDAL_CONFIG.
  from  f397283 This is typo fix patch for smbcacls.1.xml .

http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master


- Log -
commit d1ca35cbecaa788bcbb0e307ca2385c4e7f1ba0c
Author: Jelmer Vernooij jel...@samba.org
Date:   Mon Oct 18 11:35:46 2010 +0200

heimdal_build: Add dependency on com_err to HEIMDAL_CONFIG.

Autobuild-User: Jelmer Vernooij jel...@samba.org
Autobuild-Date: Mon Oct 18 10:27:47 UTC 2010 on sn-devel-104

---

Summary of changes:
 source4/heimdal_build/wscript_build |2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)


Changeset truncated at 500 lines:

diff --git a/source4/heimdal_build/wscript_build 
b/source4/heimdal_build/wscript_build
index 87ff3f5..1a00bd5 100644
--- a/source4/heimdal_build/wscript_build
+++ b/source4/heimdal_build/wscript_build
@@ -582,7 +582,7 @@ HEIMDAL_SUBSYSTEM('HEIMDAL_CONFIG',
   'lib/krb5/expand_path.c lib/krb5/plugin.c',
   includes='../heimdal/lib/krb5 ../heimdal/lib/asn1 
../heimdal/include',
   cflags=bld.dynconfig_cflags('LIBDIR BINDIR LIBEXECDIR 
SBINDIR'),
-  deps='HEIMDAL_HCRYPTO wind hx509'
+  deps='HEIMDAL_HCRYPTO wind hx509 com_err'
   )
 
 KRB5_SOURCE = [os.path.join('lib/krb5/', x) for x in to_list(


-- 
Samba Shared Repository


[SCM] Samba Shared Repository - branch master updated

2010-10-18 Thread Andrew Bartlett
The branch, master has been updated
   via  034832c s4-ldb Add LDB_REQ_SET_LOCATION to help track handler use
   via  f4c82c6 s4-selftest Make GDB_PROVISION work again
   via  48c54f9 ldb Ensure we mark ongoing LDAP requests as PENDING
   via  ce01e36 s4-openldap-backend Don't set 'dbnosync' on cn=config
   via  ba9e787 s4-provision Use --ldap-backend-nosync rather than just 
--nosync
  from  d1ca35c heimdal_build: Add dependency on com_err to HEIMDAL_CONFIG.

http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master


- Log -
commit 034832ccd5f32658f8f199d277878985e5c65470
Author: Andrew Bartlett abart...@samba.org
Date:   Mon Oct 18 22:13:20 2010 +1100

s4-ldb Add LDB_REQ_SET_LOCATION to help track handler use

This greatly assists in debugging what is going on with the
ldb handle, as it indicates where it was created.

Andrew Bartlett

Autobuild-User: Andrew Bartlett abart...@samba.org
Autobuild-Date: Mon Oct 18 11:54:46 UTC 2010 on sn-devel-104

commit f4c82c621de73bdaee7a4a9e8598ea41ec208256
Author: Andrew Bartlett abart...@samba.org
Date:   Mon Oct 18 22:11:40 2010 +1100

s4-selftest Make GDB_PROVISION work again

gdb --args won't run the #!/usr/bin/evn python

Andrew Bartlett

commit 48c54f9ec879b5ffedfe91d52202bff3d2ef1eff
Author: Andrew Bartlett abart...@samba.org
Date:   Mon Oct 18 14:06:50 2010 +1100

ldb Ensure we mark ongoing LDAP requests as PENDING

commit ce01e36d8c2e3b9857d64a648fdf683c0c267bd6
Author: Andrew Bartlett abart...@samba.org
Date:   Mon Oct 18 11:49:55 2010 +1100

s4-openldap-backend Don't set 'dbnosync' on cn=config

This isn't valid in current OpenLDAP versions.

Andrew Bartlett

commit ba9e787c7d51ab7b381361e02efad97c5814d3c7
Author: Andrew Bartlett abart...@samba.org
Date:   Mon Oct 18 11:48:14 2010 +1100

s4-provision Use --ldap-backend-nosync rather than just --nosync

For some reason we had both options, and --ldap-backend-nosync is
the better name.

Andrew Bartlett

---

Summary of changes:
 selftest/target/Samba4.pm  |8 
 source4/lib/ldb/ldb_ildap/ldb_ildap.c  |2 ++
 source4/lib/ldb/ldb_map/ldb_map.c  |2 ++
 source4/lib/ldb/ldb_map/ldb_map_inbound.c  |9 +
 source4/lib/ldb/ldb_map/ldb_map_outbound.c |1 +
 source4/lib/ldb/modules/paged_searches.c   |2 ++
 source4/setup/provision|3 +--
 source4/setup/slapd.conf   |1 -
 8 files changed, 25 insertions(+), 3 deletions(-)


Changeset truncated at 500 lines:

diff --git a/selftest/target/Samba4.pm b/selftest/target/Samba4.pm
index 574c015..ba96f08 100644
--- a/selftest/target/Samba4.pm
+++ b/selftest/target/Samba4.pm
@@ -529,9 +529,17 @@ sub provision_raw_prepare($$)
push (@provision_options, 
NSS_WRAPPER_GROUP=\$ctx-{nsswrap_group}\);
if (defined($ENV{GDB_PROVISION})) {
push (@provision_options, gdb --args);
+   if (!defined($ENV{PYTHON})) {
+   push (@provision_options, env);
+   push (@provision_options, python);
+   }
}
if (defined($ENV{VALGRIND_PROVISION})) {
push (@provision_options, valgrind);
+   if (!defined($ENV{PYTHON})) {
+   push (@provision_options, env);
+   push (@provision_options, python);
+   }
}
if (defined($ENV{PYTHON})) {
push (@provision_options, $ENV{PYTHON});
diff --git a/source4/lib/ldb/ldb_ildap/ldb_ildap.c 
b/source4/lib/ldb/ldb_ildap/ldb_ildap.c
index 98e98a8..774336b 100644
--- a/source4/lib/ldb/ldb_ildap/ldb_ildap.c
+++ b/source4/lib/ldb/ldb_ildap/ldb_ildap.c
@@ -404,6 +404,8 @@ static int ildb_request_send(struct ildb_context *ac, 
struct ldap_message *msg)
 
ldb = ldb_module_get_ctx(ac-module);
 
+   ldb_request_set_state(ac-req, LDB_ASYNC_PENDING);
+
req = ldap_request_send(ac-ildb-ldap, msg);
if (req == NULL) {
ldb_set_errstring(ldb, async send request failed);
diff --git a/source4/lib/ldb/ldb_map/ldb_map.c 
b/source4/lib/ldb/ldb_map/ldb_map.c
index 483222e..61d0d4c 100644
--- a/source4/lib/ldb/ldb_map/ldb_map.c
+++ b/source4/lib/ldb/ldb_map/ldb_map.c
@@ -891,6 +891,7 @@ struct ldb_request *map_search_base_req(struct map_context 
*ac, struct ldb_dn *d
NULL,
context, callback,
ac-req);
+   LDB_REQ_SET_LOCATION(req);
if (ret != LDB_SUCCESS) {
return NULL;
}
@@ -938,6 +939,7 @@ struct ldb_request *map_build_fixup_req(struct map_context 
*ac,
ac, msg, NULL,

[SCM] Samba Shared Repository - branch master updated

2010-10-18 Thread Andreas Schneider
The branch, master has been updated
   via  b615b70 s3-winbind: Fixed init order.
   via  abeef47 librpc: Fixed memory context of dcerpc_binding_from_tower.
   via  d42ddd7 s4-gensec: Add dependency on com_err to GENSEC_KRB5.
  from  034832c s4-ldb Add LDB_REQ_SET_LOCATION to help track handler use

http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master


- Log -
commit b615b7060188bbc33a8e8b38b2b2b14b239dc735
Author: Andreas Schneider a...@samba.org
Date:   Fri Oct 15 17:58:39 2010 +0200

s3-winbind: Fixed init order.

We need the system server info in the rpc services.

Autobuild-User: Andreas Schneider a...@samba.org
Autobuild-Date: Mon Oct 18 12:43:16 UTC 2010 on sn-devel-104

commit abeef470c4f233762950d0bf8d60760a7f8578a9
Author: Stefan Metzmacher me...@samba.org
Date:   Mon Oct 18 12:20:56 2010 +0200

librpc: Fixed memory context of dcerpc_binding_from_tower.

commit d42ddd7b603524fb9a95be2317104d2f0e456ee2
Author: Andreas Schneider a...@samba.org
Date:   Mon Oct 18 11:50:04 2010 +0200

s4-gensec: Add dependency on com_err to GENSEC_KRB5.

---

Summary of changes:
 librpc/rpc/binding.c  |4 ++--
 source3/winbindd/winbindd.c   |6 +++---
 source4/auth/gensec/wscript_build |2 +-
 3 files changed, 6 insertions(+), 6 deletions(-)


Changeset truncated at 500 lines:

diff --git a/librpc/rpc/binding.c b/librpc/rpc/binding.c
index 1b716d0..7489073 100644
--- a/librpc/rpc/binding.c
+++ b/librpc/rpc/binding.c
@@ -685,14 +685,14 @@ _PUBLIC_ NTSTATUS dcerpc_binding_from_tower(TALLOC_CTX 
*mem_ctx,
 
/* Set endpoint */
if (tower-num_floors = 4) {
-   binding-endpoint = dcerpc_floor_get_rhs_data(mem_ctx, 
tower-floors[3]);
+   binding-endpoint = dcerpc_floor_get_rhs_data(binding, 
tower-floors[3]);
} else {
binding-endpoint = NULL;
}
 
/* Set network address */
if (tower-num_floors = 5) {
-   binding-host = dcerpc_floor_get_rhs_data(mem_ctx, 
tower-floors[4]);
+   binding-host = dcerpc_floor_get_rhs_data(binding, 
tower-floors[4]);
NT_STATUS_HAVE_NO_MEMORY(binding-host);
binding-target_hostname = binding-host;
}
diff --git a/source3/winbindd/winbindd.c b/source3/winbindd/winbindd.c
index d2344fd..b8a9e16 100644
--- a/source3/winbindd/winbindd.c
+++ b/source3/winbindd/winbindd.c
@@ -1298,14 +1298,14 @@ int main(int argc, char **argv, char **envp)
 
winbindd_register_handlers();
 
-   rpc_lsarpc_init(NULL);
-   rpc_samr_init(NULL);
-
if (!init_system_info()) {
DEBUG(0,(ERROR: failed to setup system user info.\n));
exit(1);
}
 
+   rpc_lsarpc_init(NULL);
+   rpc_samr_init(NULL);
+
/* setup listen sockets */
 
if (!winbindd_setup_listeners()) {
diff --git a/source4/auth/gensec/wscript_build 
b/source4/auth/gensec/wscript_build
index dff85d6..4c8ced6 100644
--- a/source4/auth/gensec/wscript_build
+++ b/source4/auth/gensec/wscript_build
@@ -14,7 +14,7 @@ bld.SAMBA_MODULE('gensec_krb5',
source='gensec_krb5.c',
subsystem='gensec',
init_function='gensec_krb5_init',
-   deps='CREDENTIALS KERBEROS auth_session',
+   deps='CREDENTIALS KERBEROS auth_session com_err',
internal_module=False,
)
 


-- 
Samba Shared Repository


[SCM] Samba Shared Repository - branch master updated

2010-10-18 Thread Stefan Metzmacher
The branch, master has been updated
   via  20c7e2b s4:libcli/util: add pipe related NT_STATUS_RPC_* codes
   via  5c82a1b s3:libsmb: add pipe related NT_STATUS_RPC_* codes
   via  72a8966 libcli/util: add pipe related NT_STATUS_RPC_* codes
  from  b615b70 s3-winbind: Fixed init order.

http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master


- Log -
commit 20c7e2b3a37c624995bb515e65052d0a106b6ebc
Author: Stefan Metzmacher me...@samba.org
Date:   Mon Oct 11 23:04:28 2010 +0200

s4:libcli/util: add pipe related NT_STATUS_RPC_* codes

metze

Autobuild-User: Stefan Metzmacher me...@samba.org
Autobuild-Date: Mon Oct 18 13:50:55 UTC 2010 on sn-devel-104

commit 5c82a1bb0a34ed7764e913371604389b39a48130
Author: Stefan Metzmacher me...@samba.org
Date:   Mon Oct 11 23:03:34 2010 +0200

s3:libsmb: add pipe related NT_STATUS_RPC_* codes

metze

commit 72a89664993b6c7a89e4e9ce71c9a8f1752a39ec
Author: Stefan Metzmacher me...@samba.org
Date:   Mon Oct 11 23:02:38 2010 +0200

libcli/util: add pipe related NT_STATUS_RPC_* codes

metze

---

Summary of changes:
 libcli/util/ntstatus.h  |6 ++
 source3/libsmb/nterr.c  |6 ++
 source4/libcli/util/nterr.c |6 ++
 3 files changed, 18 insertions(+), 0 deletions(-)


Changeset truncated at 500 lines:

diff --git a/libcli/util/ntstatus.h b/libcli/util/ntstatus.h
index 31f9d28..32c8ce0 100644
--- a/libcli/util/ntstatus.h
+++ b/libcli/util/ntstatus.h
@@ -612,6 +612,12 @@ typedef uint32_t NTSTATUS;
 #define NT_STATUS_RPC_SS_CONTEXT_MISMATCH NT_STATUS(0xC000 | 0x30005)
 #define NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE NT_STATUS(0xC00 | 0x3000A)
 #define NT_STATUS_RPC_BAD_STUB_DATA NT_STATUS(0xC000 | 0x3000C)
+#define NT_STATUS_RPC_INVALID_PIPE_OBJECT NT_STATUS(0xC000 | 0x3005C)
+#define NT_STATUS_RPC_INVALID_PIPE_OPERATION NT_STATUS(0xC000 | 0x3005D)
+#define NT_STATUS_RPC_WRONG_PIPE_VERSION NT_STATUS(0xC000 | 0x3005E)
+#define NT_STATUS_RPC_PIPE_CLOSED NT_STATUS(0xC000 | 0x3005F)
+#define NT_STATUS_RPC_PIPE_DISCIPLINE_ERROR NT_STATUS(0xC000 | 0x30060)
+#define NT_STATUS_RPC_PIPE_EMPTY NT_STATUS(0xC000 | 0x30061)
 #define NT_STATUS_ERROR_DS_OBJ_STRING_NAME_EXISTS NT_STATUS(0xC000 | 
0x2071)
 #define NT_STATUS_ERROR_DS_INCOMPATIBLE_VERSION NT_STATUS(0xC000 | 
0x2177)
 
diff --git a/source3/libsmb/nterr.c b/source3/libsmb/nterr.c
index 817bb56..44f3b3f 100644
--- a/source3/libsmb/nterr.c
+++ b/source3/libsmb/nterr.c
@@ -553,6 +553,12 @@ static const nt_err_code_struct nt_errs[] =
{ NT_STATUS_RPC_SS_CONTEXT_MISMATCH, 
NT_STATUS_RPC_SS_CONTEXT_MISMATCH },
{ NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE, 
NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE },
{ NT_STATUS_RPC_BAD_STUB_DATA, NT_STATUS_RPC_BAD_STUB_DATA },
+   { NT_STATUS_RPC_INVALID_PIPE_OBJECT, 
NT_STATUS_RPC_INVALID_PIPE_OBJECT },
+   { NT_STATUS_RPC_INVALID_PIPE_OPERATION, 
NT_STATUS_RPC_INVALID_PIPE_OPERATION },
+   { NT_STATUS_RPC_WRONG_PIPE_VERSION, NT_STATUS_RPC_WRONG_PIPE_VERSION 
},
+   { NT_STATUS_RPC_PIPE_CLOSED, NT_STATUS_RPC_PIPE_CLOSED },
+   { NT_STATUS_RPC_PIPE_DISCIPLINE_ERROR, 
NT_STATUS_RPC_PIPE_DISCIPLINE_ERROR },
+   { NT_STATUS_RPC_PIPE_EMPTY, NT_STATUS_RPC_PIPE_EMPTY },
{ NULL, NT_STATUS(0) }
 };
 
diff --git a/source4/libcli/util/nterr.c b/source4/libcli/util/nterr.c
index 3a850a0..72a7b37 100644
--- a/source4/libcli/util/nterr.c
+++ b/source4/libcli/util/nterr.c
@@ -554,6 +554,12 @@ static const nt_err_code_struct nt_errs[] =
{ NT_STATUS_RPC_SS_CONTEXT_MISMATCH, 
NT_STATUS_RPC_SS_CONTEXT_MISMATCH },
{ NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE, 
NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE },
{ NT_STATUS_RPC_BAD_STUB_DATA, NT_STATUS_RPC_BAD_STUB_DATA },
+   { NT_STATUS_RPC_INVALID_PIPE_OBJECT, 
NT_STATUS_RPC_INVALID_PIPE_OBJECT },
+   { NT_STATUS_RPC_INVALID_PIPE_OPERATION, 
NT_STATUS_RPC_INVALID_PIPE_OPERATION },
+   { NT_STATUS_RPC_WRONG_PIPE_VERSION, NT_STATUS_RPC_WRONG_PIPE_VERSION 
},
+   { NT_STATUS_RPC_PIPE_CLOSED, NT_STATUS_RPC_PIPE_CLOSED },
+   { NT_STATUS_RPC_PIPE_DISCIPLINE_ERROR, 
NT_STATUS_RPC_PIPE_DISCIPLINE_ERROR },
+   { NT_STATUS_RPC_PIPE_EMPTY, NT_STATUS_RPC_PIPE_EMPTY },
{ NT_STATUS_CURRENT_DOMAIN_NOT_ALLOWED, 
NT_STATUS_CURRENT_DOMAIN_NOT_ALLOWED },
{ NT_STATUS_OBJECTID_NOT_FOUND, NT_STATUS_OBJECTID_NOT_FOUND },
{ NT_STATUS_DOWNGRADE_DETECTED, NT_STATUS_DOWNGRADE_DETECTED },


-- 
Samba Shared Repository


[SCM] Samba Shared Repository - branch master updated

2010-10-18 Thread Günther Deschner
The branch, master has been updated
   via  64e9f79 s3: fix the build of idmap_adex, idmap_tdb2, idmap_hash and 
several vfs modules.
   via  5845dae s3-waf: fix the build after libcli/security changes.
   via  203dc4f s3-waf: fix the build of smbtorture.
   via  10f95a4 s3-waf: fix pdb modules build.
  from  20c7e2b s4:libcli/util: add pipe related NT_STATUS_RPC_* codes

http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master


- Log -
commit 64e9f79587916c0e8e9079636e3a2ab60ea2b455
Author: Günther Deschner g...@samba.org
Date:   Mon Oct 18 15:55:47 2010 +0200

s3: fix the build of idmap_adex, idmap_tdb2, idmap_hash and several vfs 
modules.

Guenther

Autobuild-User: Günther Deschner g...@samba.org
Autobuild-Date: Mon Oct 18 14:39:39 UTC 2010 on sn-devel-104

commit 5845dae8262a648d3af7b73044483e8bed2f4f08
Author: Günther Deschner g...@samba.org
Date:   Mon Oct 18 15:55:16 2010 +0200

s3-waf: fix the build after libcli/security changes.

Guenther

commit 203dc4f929640ad704b96efc043daa2d97556af3
Author: Günther Deschner g...@samba.org
Date:   Tue Oct 12 00:46:53 2010 +0200

s3-waf: fix the build of smbtorture.

Guenther

commit 10f95a4f1a5f08c5b58b5f5d10921d792997c352
Author: Günther Deschner g...@samba.org
Date:   Tue Oct 12 00:26:03 2010 +0200

s3-waf: fix pdb modules build.

Guenther

---

Summary of changes:
 librpc/wscript_build   |2 +-
 source3/modules/nfs4_acls.c|1 +
 source3/passdb/wscript_build   |   27 ++---
 source3/winbindd/idmap_adex/likewise_cell.c|1 +
 source3/winbindd/idmap_adex/provider_unified.c |1 +
 source3/winbindd/idmap_hash/idmap_hash.c   |1 +
 source3/winbindd/idmap_tdb2.c  |1 +
 source3/wscript_build  |   29 +--
 8 files changed, 35 insertions(+), 28 deletions(-)


Changeset truncated at 500 lines:

diff --git a/librpc/wscript_build b/librpc/wscript_build
index 0e6c8c0..631bb83 100644
--- a/librpc/wscript_build
+++ b/librpc/wscript_build
@@ -298,7 +298,7 @@ bld.SAMBA_SUBSYSTEM('RPC_NDR_AUDIOSRV',
 
 bld.SAMBA_SUBSYSTEM('RPC_NDR_ECHO',
source='../librpc/gen_ndr/ndr_echo_c.c',
-   public_deps='dcerpc NDR_STANDARD'
+   public_deps='dcerpc NDR_ECHO'
)
 
 bld.SAMBA_SUBSYSTEM('RPC_NDR_DSBACKUP',
diff --git a/source3/modules/nfs4_acls.c b/source3/modules/nfs4_acls.c
index 7e5f994..1913946 100644
--- a/source3/modules/nfs4_acls.c
+++ b/source3/modules/nfs4_acls.c
@@ -21,6 +21,7 @@
 #include nfs4_acls.h
 #include librpc/gen_ndr/ndr_security.h
 #include ../libcli/security/dom_sid.h
+#include ../libcli/security/security.h
 #include include/dbwrap.h
 
 #undef DBGC_CLASS
diff --git a/source3/passdb/wscript_build b/source3/passdb/wscript_build
index d4a6f57..665b759 100644
--- a/source3/passdb/wscript_build
+++ b/source3/passdb/wscript_build
@@ -1,48 +1,47 @@
 #!/usr/bin/env python
 
-PDB_STATIC =''
 PDB_TDBSAM_SRC ='pdb_tdb.c'
 PDB_LDAP_SRC =  'pdb_ldap.c pdb_nds.c'
 PDB_ADS_SRC =   'pdb_ads.c'
 PDB_SMBPASSWD_SRC = 'pdb_smbpasswd.c'
 PDB_WBC_SAM_SRC =   'pdb_wbc_sam.c'
 
-bld.SAMBA_SUBSYSTEM('PDB',
-source='',
-deps='''PDB_TDBSAM PDB_LDAP PDB_ADS PDB_SMBPASSWD 
PDB_WBC_SAM''',
+bld.SAMBA_SUBSYSTEM('pdb',
+source='pdb_interface.c',
+deps='',
 vars=locals())
 
-bld.SAMBA_MODULE('PDB_TDBSAM',
- subsystem='PDB',
+bld.SAMBA_MODULE('pdb_tdbsam',
+ subsystem='pdb',
  source=PDB_TDBSAM_SRC,
  init_function='',
  internal_module=bld.SAMBA3_IS_STATIC_MODULE('PDB_TDBSAM'),
  enabled=bld.SAMBA3_IS_ENABLED_MODULE('PDB_TDBSAM'))
 
-bld.SAMBA_MODULE('PDB_LDAP',
- subsystem='PDB',
+bld.SAMBA_MODULE('pdb_ldap',
+ subsystem='pdb',
  source=PDB_LDAP_SRC,
  init_function='',
  internal_module=bld.SAMBA3_IS_STATIC_MODULE('PDB_LDAP'),
  enabled=bld.SAMBA3_IS_ENABLED_MODULE('PDB_LDAP'))
 
-bld.SAMBA_MODULE('PDB_ADS',
- subsystem='PDB',
+bld.SAMBA_MODULE('pdb_ads',
+ subsystem='pdb',
  source=PDB_ADS_SRC,
  deps='LIBCLI_LDAP_NDR',
  init_function='',
  internal_module=bld.SAMBA3_IS_STATIC_MODULE('PDB_ADS'),
  enabled=bld.SAMBA3_IS_ENABLED_MODULE('PDB_ADS'))
 
-bld.SAMBA_MODULE('PDB_SMBPASSWD',
- subsystem='PDB',
+bld.SAMBA_MODULE('pdb_smbpasswd',
+ subsystem='pdb',
  source=PDB_SMBPASSWD_SRC,
  init_function='',
  

[SCM] Samba Shared Repository - branch master updated

2010-10-18 Thread Tim Potter
The branch, master has been updated
   via  a10b341 Include misc.idl for policy_handle in srvsvc.idl.
  from  64e9f79 s3: fix the build of idmap_adex, idmap_tdb2, idmap_hash and 
several vfs modules.

http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master


- Log -
commit a10b3416e558e16f82b80a0794485c1fcbda9371
Author: Tim Potter t...@samba.org
Date:   Mon Oct 18 07:54:31 2010 -0700

Include misc.idl for policy_handle in srvsvc.idl.

Autobuild-User: Tim Potter t...@samba.org
Autobuild-Date: Mon Oct 18 15:35:40 UTC 2010 on sn-devel-104

---

Summary of changes:
 librpc/idl/srvsvc.idl |2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)


Changeset truncated at 500 lines:

diff --git a/librpc/idl/srvsvc.idl b/librpc/idl/srvsvc.idl
index 153d8cf..c49849e 100644
--- a/librpc/idl/srvsvc.idl
+++ b/librpc/idl/srvsvc.idl
@@ -3,7 +3,7 @@
 /*
   srvsvc interface definitions
 */
-import security.idl, svcctl.idl;
+import misc.idl, security.idl, svcctl.idl;
 
 [ uuid(4b324fc8-1670-01d3-1278-5a47bf6ee188),
   version(3.0),


-- 
Samba Shared Repository


[SCM] Samba Shared Repository - branch master updated

2010-10-18 Thread Stefan Metzmacher
The branch, master has been updated
   via  a610ce4 libcli/nbt: we don't need LIBCLI_COMPOSITE anymore
   via  820ae3d libcli/nbt: convert nbt_name_register_bcast_send/recv to 
tevent_req
   via  0b8056d libcli/nbt: 
s/name_register_bcast_handler/nbt_name_register_bcast_handler
   via  c654a6c libcli/nbt: 
s/register_bcast_state/nbt_name_register_bcast_state/
   via  77d82fe libcli/nbt: move nbt_name_register_bcast_send to the top of 
nbt_name_register_bcast_*
   via  6f2d94b s4:nbt_server/register: add a nbtd_register_name_state
   via  e3a0463 libcli/nbt: convert nbt_name_register_wins_send/recv to 
tevent_req
   via  4f233c7 libcli/nbt: 
s/name_register_wins_handler/nbt_name_register_wins_handler
   via  b166813 libcli/nbt: 
s/register_wins_state/nbt_name_register_wins_state
   via  549b594 libcli/nbt: move nbt_name_register_wins_send() to the top 
of all nbt_name_register_wins_* related code
   via  12c3880 s4:nbt_server/winsclient: add a nbtd_wins_register_state
   via  43fb7f1 libcli/nbt: convert nbt_name_refresh_wins_send/recv to 
tevent_req
   via  332f261 libcli/nbt: 
s/name_refresh_wins_handler/nbt_name_refresh_wins_handler
   via  3ded1da libcli/nbt: s/refresh_wins_state/nbt_name_refresh_wins_state
   via  e36e729 libcli/nbt: move nbt_name_refresh_wins_send() to the top of 
all nbt_name_refresh_wins_* related code
   via  5f19a24 s4:nbt_server/winsclient: add a nbtd_wins_refresh_state
   via  2ae3bb0 s4:nbt_server/wins: fix compiler warnings
  from  a10b341 Include misc.idl for policy_handle in srvsvc.idl.

http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master


- Log -
commit a610ce4aa63b5bbe0886e510f7ccd9a6f95e266d
Author: Stefan Metzmacher me...@samba.org
Date:   Mon Oct 11 22:29:30 2010 +0200

libcli/nbt: we don't need LIBCLI_COMPOSITE anymore

metze

Autobuild-User: Stefan Metzmacher me...@samba.org
Autobuild-Date: Mon Oct 18 16:18:32 UTC 2010 on sn-devel-104

commit 820ae3d9a36e031027be163d22eec468a6da8603
Author: Stefan Metzmacher me...@samba.org
Date:   Mon Oct 11 21:18:15 2010 +0200

libcli/nbt: convert nbt_name_register_bcast_send/recv to tevent_req

metze

commit 0b8056d580e2d2475b208c73ffb698b0bcd487eb
Author: Stefan Metzmacher me...@samba.org
Date:   Mon Oct 11 21:01:23 2010 +0200

libcli/nbt: s/name_register_bcast_handler/nbt_name_register_bcast_handler

metze

commit c654a6c02bbd7c7a245b2a06e405d88724c12fc7
Author: Stefan Metzmacher me...@samba.org
Date:   Mon Oct 11 20:59:35 2010 +0200

libcli/nbt: s/register_bcast_state/nbt_name_register_bcast_state/

metze

commit 77d82fe944fa1f02c150cc2e0967cca654cd4dae
Author: Stefan Metzmacher me...@samba.org
Date:   Mon Oct 11 20:57:58 2010 +0200

libcli/nbt: move nbt_name_register_bcast_send to the top of 
nbt_name_register_bcast_*

metze

commit 6f2d94b960bb6d23ff8932eff2b44722cf335280
Author: Stefan Metzmacher me...@samba.org
Date:   Mon Oct 11 22:17:02 2010 +0200

s4:nbt_server/register: add a nbtd_register_name_state

metze

commit e3a0463414ba7759d332d5bebf6222bfa17ed037
Author: Stefan Metzmacher me...@samba.org
Date:   Mon Oct 11 21:58:29 2010 +0200

libcli/nbt: convert nbt_name_register_wins_send/recv to tevent_req

metze

commit 4f233c7ff8b23b0dd4797e08d7dc680598e1b844
Author: Stefan Metzmacher me...@samba.org
Date:   Mon Oct 11 21:23:58 2010 +0200

libcli/nbt: s/name_register_wins_handler/nbt_name_register_wins_handler

metze

commit b16681374c6c4d010a74bb2cb914ac226643c634
Author: Stefan Metzmacher me...@samba.org
Date:   Mon Oct 11 21:21:26 2010 +0200

libcli/nbt: s/register_wins_state/nbt_name_register_wins_state

metze

commit 549b594c5798954de056cf7e3858e94f1b965bdb
Author: Stefan Metzmacher me...@samba.org
Date:   Mon Oct 11 21:19:59 2010 +0200

libcli/nbt: move nbt_name_register_wins_send() to the top of all 
nbt_name_register_wins_* related code

metze

commit 12c38806af46da329e2f370d32a4fa964ceeb23f
Author: Stefan Metzmacher me...@samba.org
Date:   Mon Oct 11 20:49:28 2010 +0200

s4:nbt_server/winsclient: add a nbtd_wins_register_state

We now keep the nbtd_wins_register_state around between
nbt_name_register_wins_send() and nbt_name_register_wins_recv()

metze

commit 43fb7f1698c0c8aaa7f1e5d6a0f924396a9a12fe
Author: Stefan Metzmacher me...@samba.org
Date:   Mon Oct 11 08:54:27 2010 +0200

libcli/nbt: convert nbt_name_refresh_wins_send/recv to tevent_req

metze

commit 332f261bbf5a3179cbab6cb7aa8b490d0072b7af
Author: Stefan Metzmacher me...@samba.org
Date:   Mon Oct 11 08:33:06 2010 +0200

libcli/nbt: s/name_refresh_wins_handler/nbt_name_refresh_wins_handler

metze

commit 3ded1da8e99a628530d0a45256e012b7553c094c
Author: Stefan Metzmacher me...@samba.org
Date:   Mon Oct 11 08:18:16 2010 +0200


[SCM] Samba Shared Repository - branch master updated

2010-10-18 Thread Matthias Dieter Wallnöfer
The branch, master has been updated
   via  8556602 ldb:ldb_schema_attribute_by_name_internal - switch back 
to 32bit counters
   via  48cd89e ldb:ldb_tdb.c - fix up counter variables
   via  94a4458 ldb:ldb_tdb.c - improve the error outputs
   via  3ead246 s4:util_ldb - remove some really unused dependancies
  from  a610ce4 libcli/nbt: we don't need LIBCLI_COMPOSITE anymore

http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master


- Log -
commit 8556602b048e825b35df314d6865f997823ec2bb
Author: Matthias Dieter Wallnöfer m...@samba.org
Date:   Mon Oct 18 20:19:00 2010 +0200

ldb:ldb_schema_attribute_by_name_internal - switch back to 32bit counters

Use the signed counter for the binary search but use an unsigned one for
accessing the entry.

Autobuild-User: Matthias Dieter Wallnöfer m...@samba.org
Autobuild-Date: Mon Oct 18 19:01:31 UTC 2010 on sn-devel-104

commit 48cd89e25d58d5d2fd0dbb7ce4a0e8b96e3e6044
Author: Matthias Dieter Wallnöfer m...@samba.org
Date:   Mon Oct 18 20:10:17 2010 +0200

ldb:ldb_tdb.c - fix up counter variables

find_element returns an int since there is also the possibility that a
certain element doesn't exist - then -1 is returned. But beside this
exception treat all other return values as unsigned.

commit 94a445869c5fa3bb6df542c494e8822478f790e8
Author: Matthias Dieter Wallnöfer m...@samba.org
Date:   Mon Oct 18 20:07:49 2010 +0200

ldb:ldb_tdb.c - improve the error outputs

- Fix indentation
- Include always the failing DN
- Reorder the outputs to make them consistent

commit 3ead246062b927e44cb75e684cc67c41109d63c4
Author: Matthias Dieter Wallnöfer m...@samba.org
Date:   Mon Oct 18 19:24:43 2010 +0200

s4:util_ldb - remove some really unused dependancies

---

Summary of changes:
 source4/auth/credentials/config.mk |2 +-
 source4/auth/credentials/credentials_secrets.c |1 -
 source4/auth/ntlm/auth_sam.c   |1 -
 source4/auth/wscript_build |2 +-
 source4/dsdb/samdb/ldb_modules/samba3sid.c |1 -
 source4/dsdb/samdb/ldb_modules/samldb.c|1 -
 source4/kdc/db-glue.c  |1 -
 source4/lib/basic.mk   |2 +-
 source4/lib/ldb-samba/wscript_build|2 +-
 source4/lib/ldb/common/ldb_attributes.c|9 ++--
 source4/lib/ldb/ldb_tdb/ldb_tdb.c  |   51 +++
 source4/libnet/libnet_join.c   |1 -
 source4/nbt_server/dgram/netlogon.c|1 -
 13 files changed, 42 insertions(+), 33 deletions(-)


Changeset truncated at 500 lines:

diff --git a/source4/auth/credentials/config.mk 
b/source4/auth/credentials/config.mk
index 9762966..2d35180 100644
--- a/source4/auth/credentials/config.mk
+++ b/source4/auth/credentials/config.mk
@@ -2,7 +2,7 @@
 # Start SUBSYSTEM CREDENTIALS
 [SUBSYSTEM::CREDENTIALS]
 PUBLIC_DEPENDENCIES = \
-   LIBCLI_AUTH SECRETS LIBCRYPTO KERBEROS UTIL_LDB HEIMDAL_GSSAPI
+   LIBCLI_AUTH SECRETS LIBCRYPTO KERBEROS HEIMDAL_GSSAPI
 PRIVATE_DEPENDENCIES = \
SECRETS SAMDB
 
diff --git a/source4/auth/credentials/credentials_secrets.c 
b/source4/auth/credentials/credentials_secrets.c
index 8c8043c..210590c 100644
--- a/source4/auth/credentials/credentials_secrets.c
+++ b/source4/auth/credentials/credentials_secrets.c
@@ -27,7 +27,6 @@
 #include librpc/gen_ndr/samr.h /* for struct samrPassword */
 #include param/secrets.h
 #include system/filesys.h
-#include ../lib/util/util_ldb.h
 #include auth/credentials/credentials.h
 #include auth/credentials/credentials_krb5.h
 #include auth/kerberos/kerberos_util.h
diff --git a/source4/auth/ntlm/auth_sam.c b/source4/auth/ntlm/auth_sam.c
index 8de33ff..259efec 100644
--- a/source4/auth/ntlm/auth_sam.c
+++ b/source4/auth/ntlm/auth_sam.c
@@ -22,7 +22,6 @@
 #include includes.h
 #include system/time.h
 #include lib/ldb/include/ldb.h
-#include ../lib/util/util_ldb.h
 #include libcli/ldap/ldap_ndr.h
 #include libcli/security/security.h
 #include auth/auth.h
diff --git a/source4/auth/wscript_build b/source4/auth/wscript_build
index 38fb1b7..e44a032 100644
--- a/source4/auth/wscript_build
+++ b/source4/auth/wscript_build
@@ -33,7 +33,7 @@ bld.SAMBA_SUBSYSTEM('auth_system_session',
 bld.SAMBA_SUBSYSTEM('auth_sam',
source='sam.c',
autoproto='auth_sam.h',
-   public_deps='SAMDB UTIL_LDB LIBSECURITY ldb tevent',
+   public_deps='SAMDB LIBSECURITY ldb tevent',
deps=''
)
 
diff --git a/source4/dsdb/samdb/ldb_modules/samba3sid.c 
b/source4/dsdb/samdb/ldb_modules/samba3sid.c
index a5b3df1..f6db0d1 100644
--- a/source4/dsdb/samdb/ldb_modules/samba3sid.c
+++ b/source4/dsdb/samdb/ldb_modules/samba3sid.c
@@ -29,7 +29,6 @@
 #include 

[SCM] Samba Shared Repository - branch master updated

2010-10-18 Thread Matthieu Patou
The branch, master has been updated
   via  902e728 selftest: use full path for selftest.pl instead of relative 
paths
   via  b1a13e5 selftest: correct the import of Time::HighRes
  from  8556602 ldb:ldb_schema_attribute_by_name_internal - switch back 
to 32bit counters

http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master


- Log -
commit 902e7288a738c0580c466ae4c5c503d604c66e6e
Author: Matthieu Patou m...@matws.net
Date:   Mon Oct 18 22:23:00 2010 +0400

selftest: use full path for selftest.pl instead of relative paths

FindBin on solaris8 with perl 5.04 has problem to get the path of the
called script if the script is called with a relative path.

Autobuild-User: Matthieu Patou m...@samba.org
Autobuild-Date: Mon Oct 18 19:50:03 UTC 2010 on sn-devel-104

commit b1a13e5e1453b6f776e0a35f293f4060c77fe59a
Author: Matthieu Patou m...@matws.net
Date:   Mon Oct 18 20:21:12 2010 +0400

selftest: correct the import of Time::HighRes

The use is always evaluated first even if enclosed into a if. So
on plateform without Time::Hires (ie. sun8 in the build farm). This
leads to an error.

Instead we use the synthax require Module + Module-import(function)

---

Summary of changes:
 selftest/selftest.pl |5 +++--
 source4/selftest/wscript |3 ++-
 2 files changed, 5 insertions(+), 3 deletions(-)


Changeset truncated at 500 lines:

diff --git a/selftest/selftest.pl b/selftest/selftest.pl
index 08ee52c..7431bed 100755
--- a/selftest/selftest.pl
+++ b/selftest/selftest.pl
@@ -135,9 +135,10 @@ use SocketWrapper;
 
 eval {
 require Time::HiRes;
+Time::HiRes-import(time);
 };
-unless ($@) {
-   use Time::HiRes qw(time);
+if ($@) {
+   print You don't have Time::Hires installed !\n;
 }
 
 my $opt_help = 0;
diff --git a/source4/selftest/wscript b/source4/selftest/wscript
index 249db5e..2f4e436 100644
--- a/source4/selftest/wscript
+++ b/source4/selftest/wscript
@@ -148,7 +148,8 @@ def cmd_testonly(opt):
 if os.path.exists(st_done):
 os.unlink(st_done)
 
-cmd = '(${PERL} ../selftest/selftest.pl --prefix=${SELFTEST_PREFIX} 
--builddir=. --srcdir=. --exclude=./selftest/skip --testlist=${PYTHON} 
./selftest/tests.py| ${OPTIONS} --socket-wrapper ${TESTS}  touch 
${SELFTEST_PREFIX}/st_done) | ${FILTER_OPTIONS} | tee 
${SELFTEST_PREFIX}/subunit'
+# We use the full path rather than relative path because it cause problems 
on some plateforms (ie. solaris 8).
+cmd = '(${PERL} %s/../selftest/selftest.pl --prefix=${SELFTEST_PREFIX} 
--builddir=. --srcdir=. --exclude=./selftest/skip --testlist=${PYTHON} 
./selftest/tests.py| ${OPTIONS} --socket-wrapper ${TESTS}  touch 
${SELFTEST_PREFIX}/st_done) | ${FILTER_OPTIONS} | tee 
${SELFTEST_PREFIX}/subunit' % (os.getcwd())
 if os.environ.get('RUN_FROM_BUILD_FARM') is None and not 
Options.options.FILTERED_SUBUNIT:
 cmd += ' | ${FORMAT_TEST_OUTPUT}'
 cmd = EXPAND_VARIABLES(opt, cmd)


-- 
Samba Shared Repository


[SCM] Samba Shared Repository - branch master updated

2010-10-18 Thread Matthias Dieter Wallnöfer
The branch, master has been updated
   via  1ac19c1 s4:ldap_server - use error code constant
   via  dcbfcbb ldb: always return PROTOCOL_ERROR if an operation is 
unsupported
  from  902e728 selftest: use full path for selftest.pl instead of relative 
paths

http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master


- Log -
commit 1ac19c1ca3164dc6a1b29ce81047bab81a9af918
Author: Matthias Dieter Wallnöfer m...@samba.org
Date:   Mon Oct 18 21:22:37 2010 +0200

s4:ldap_server - use error code constant

Autobuild-User: Matthias Dieter Wallnöfer m...@samba.org
Autobuild-Date: Mon Oct 18 20:32:40 UTC 2010 on sn-devel-104

commit dcbfcbbceb87e742b642a9dffee1304dcf0b93bb
Author: Matthias Dieter Wallnöfer m...@samba.org
Date:   Mon Oct 18 21:21:45 2010 +0200

ldb: always return PROTOCOL_ERROR if an operation is unsupported

That's exactly the behaviour of various LDAP servers.

---

Summary of changes:
 source4/ldap_server/ldap_backend.c|2 +-
 source4/lib/ldb/ldb_ildap/ldb_ildap.c |2 +-
 source4/lib/ldb/ldb_ldap/ldb_ldap.c   |2 +-
 source4/lib/ldb/ldb_sqlite3/ldb_sqlite3.c |2 +-
 source4/lib/ldb/ldb_tdb/ldb_tdb.c |2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)


Changeset truncated at 500 lines:

diff --git a/source4/ldap_server/ldap_backend.c 
b/source4/ldap_server/ldap_backend.c
index 6f2a764..bab5923 100644
--- a/source4/ldap_server/ldap_backend.c
+++ b/source4/ldap_server/ldap_backend.c
@@ -1157,6 +1157,6 @@ NTSTATUS ldapsrv_do_call(struct ldapsrv_call *call)
case LDAP_TAG_ExtendedRequest:
return ldapsrv_ExtendedRequest(call);
default:
-   return ldapsrv_unwilling(call, 2);
+   return ldapsrv_unwilling(call, LDAP_PROTOCOL_ERROR);
}
 }
diff --git a/source4/lib/ldb/ldb_ildap/ldb_ildap.c 
b/source4/lib/ldb/ldb_ildap/ldb_ildap.c
index 774336b..dab5abf 100644
--- a/source4/lib/ldb/ldb_ildap/ldb_ildap.c
+++ b/source4/lib/ldb/ldb_ildap/ldb_ildap.c
@@ -759,7 +759,7 @@ static int ildb_handle_request(struct ldb_module *module, 
struct ldb_request *re
break;
default:
/* no other op supported */
-   ret = LDB_ERR_OPERATIONS_ERROR;
+   ret = LDB_ERR_PROTOCOL_ERROR;
break;
}
 
diff --git a/source4/lib/ldb/ldb_ldap/ldb_ldap.c 
b/source4/lib/ldb/ldb_ldap/ldb_ldap.c
index 8383627..b83ca87 100644
--- a/source4/lib/ldb/ldb_ldap/ldb_ldap.c
+++ b/source4/lib/ldb/ldb_ldap/ldb_ldap.c
@@ -810,7 +810,7 @@ static int lldb_handle_request(struct ldb_module *module, 
struct ldb_request *re
break;
default:
/* no other op supported */
-   ret = LDB_ERR_OPERATIONS_ERROR;
+   ret = LDB_ERR_PROTOCOL_ERROR;
break;
}
 
diff --git a/source4/lib/ldb/ldb_sqlite3/ldb_sqlite3.c 
b/source4/lib/ldb/ldb_sqlite3/ldb_sqlite3.c
index 2225327..3aa6672 100644
--- a/source4/lib/ldb/ldb_sqlite3/ldb_sqlite3.c
+++ b/source4/lib/ldb/ldb_sqlite3/ldb_sqlite3.c
@@ -1520,7 +1520,7 @@ static void lsql_callback(struct tevent_context *ev,
  */
default:
/* no other op supported */
-   ret = LDB_ERR_UNWILLING_TO_PERFORM;
+   ret = LDB_ERR_PROTOCOL_ERROR;
}
 
if (!ctx-callback_failed) {
diff --git a/source4/lib/ldb/ldb_tdb/ldb_tdb.c 
b/source4/lib/ldb/ldb_tdb/ldb_tdb.c
index 4350537..1637c66 100644
--- a/source4/lib/ldb/ldb_tdb/ldb_tdb.c
+++ b/source4/lib/ldb/ldb_tdb/ldb_tdb.c
@@ -1241,7 +1241,7 @@ static void ltdb_callback(struct tevent_context *ev,
goto done;
default:
/* no other op supported */
-   ret = LDB_ERR_UNWILLING_TO_PERFORM;
+   ret = LDB_ERR_PROTOCOL_ERROR;
}
 
if (!ctx-request_terminated) {


-- 
Samba Shared Repository


[SCM] Samba Shared Repository - branch master updated

2010-10-18 Thread Andrew Tridgell
The branch, master has been updated
   via  f6a9708 s4-ldb: increase minor version for 2 new functions
   via  423365d s4-ldap: mark all ldap:// requests as untrusted
   via  80a4adc s4-dsdb: filter unregistered controls in the rootdse module
   via  d16fe72 s4-ldb: cope with NULL oid in controls
   via  5f6c004 s4-ldb: added --relax cmdline option
   via  ff456cd s4-ldb: added ldb_req_mark_untrusted() and 
ldb_req_is_untrusted()
   via  968381a waf: put -Wl,-no-undefined only in the linker flags, not 
when compiling C
   via  1b83558 waf: don't save deps on install
   via  d485701 waf: automap shared library names from .so to the right 
extension
   via  7197bcc readline: fixed the test for history_list()
   via  ec90b24 replace: cope with systems that have fdatasync(), but don't 
have the prototype
  from  1ac19c1 s4:ldap_server - use error code constant

http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master


- Log -
commit f6a9708b546ac54a74c8718aedd9e5ac976fc72b
Author: Andrew Tridgell tri...@samba.org
Date:   Tue Oct 19 11:47:22 2010 +1100

s4-ldb: increase minor version for 2 new functions

Pair-Programmed-With: Andrew Bartlett abart...@samba.org

Autobuild-User: Andrew Tridgell tri...@samba.org
Autobuild-Date: Tue Oct 19 01:27:44 UTC 2010 on sn-devel-104

commit 423365d5fa6b66f8be370accedfc6ed04d6df6b3
Author: Andrew Tridgell tri...@samba.org
Date:   Tue Oct 19 11:22:12 2010 +1100

s4-ldap: mark all ldap:// requests as untrusted

this allows the rootdse module to filter unregistered controls

Pair-Programmed-With: Andrew Bartlett abart...@samba.org

commit 80a4adc062a64e25a9ba0986e426c21599d1a366
Author: Andrew Tridgell tri...@samba.org
Date:   Tue Oct 19 11:21:45 2010 +1100

s4-dsdb: filter unregistered controls in the rootdse module

if we get an unregistered control in the rootdse module, and the
request comes from an untrusted source (eg. ldap://) then we need to:

 1) filter the control out if it is marked non-critical

 2) give an error if it is marked critical

Pair-Programmed-With: Andrew Bartlett abart...@samba.org

commit d16fe72585445e7fd3724a7413ca7e03ee633fc9
Author: Andrew Tridgell tri...@samba.org
Date:   Tue Oct 19 11:20:14 2010 +1100

s4-ldb: cope with NULL oid in controls

the ldap server will mark a control with a NULL oid in order to remove
it. This prevents a O(n^2) cost in control handling.

Pair-Programmed-With: Andrew Bartlett abart...@samba.org

commit 5f6c004dec2140755ddfe5f801775e19a03a7ec8
Author: Andrew Tridgell tri...@samba.org
Date:   Tue Oct 19 11:19:20 2010 +1100

s4-ldb: added --relax cmdline option

this adds the relax control

commit ff456cd1007dc06a51c5e60394964bcf898b24d2
Author: Andrew Tridgell tri...@samba.org
Date:   Tue Oct 19 11:17:53 2010 +1100

s4-ldb: added ldb_req_mark_untrusted() and ldb_req_is_untrusted()

these will be used to determine if a ldb request comes from an
untrusted source. We want requests over ldap:// to be marked untrusted
so we can reject unregistered controls

Pair-Programmed-With: Andrew Bartlett abart...@samba.org

commit 968381a4e2e7c8350b89104c17568259d35787a5
Author: Andrew Tridgell tri...@samba.org
Date:   Mon Oct 18 15:17:56 2010 +1100

waf: put -Wl,-no-undefined only in the linker flags, not when compiling C

commit 1b8355897d1db0a127b6357ff5a3b2eb1c1e3b71
Author: Andrew Tridgell tri...@samba.org
Date:   Sun Oct 17 22:34:17 2010 +1100

waf: don't save deps on install

this prevents an install triggering a new check of the project rules
on the next build

commit d48570143656d1c570c282f8e21e058508910f3c
Author: Andrew Tridgell tri...@samba.org
Date:   Sun Oct 17 21:58:22 2010 +1100

waf: automap shared library names from .so to the right extension

this should help with MacOSX .dylib libraries

commit 7197bcc513e707676f10734cffd6f2f494a360c1
Author: Andrew Tridgell tri...@samba.org
Date:   Sat Oct 16 19:54:05 2010 +1100

readline: fixed the test for history_list()

commit ec90b249ecbd415c931630070b0831c6cf86d2d4
Author: Andrew Tridgell tri...@samba.org
Date:   Sat Oct 16 19:53:17 2010 +1100

replace: cope with systems that have fdatasync(), but don't have the 
prototype

this is needed for MacOSX 10.4.1

---

Summary of changes:
 buildtools/wafsamba/samba_autoconf.py  |   27 +-
 buildtools/wafsamba/samba_deps.py  |3 +-
 buildtools/wafsamba/samba_install.py   |   18 ++--
 buildtools/wafsamba/samba_utils.py |   39 
 buildtools/wafsamba/wafsamba.py|9 +-
 buildtools/wafsamba/wscript|7 +-
 lib/replace/libreplace.m4 

[SCM] Samba Shared Repository - branch master updated

2010-10-18 Thread Andrew Tridgell
The branch, master has been updated
   via  640fbf8 s4-dsdb: register the DCPROMO_OID control with the rootdse
   via  75d57db selftest: terminate selftest if we can't setup the 
environment
  from  f6a9708 s4-ldb: increase minor version for 2 new functions

http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master


- Log -
commit 640fbf833b824d3c4c2ecfecdb75fade2ef70fa9
Author: Andrew Tridgell tri...@samba.org
Date:   Tue Oct 19 14:53:14 2010 +1100

s4-dsdb: register the DCPROMO_OID control with the rootdse

this is needed to allow it over ldap

Autobuild-User: Andrew Tridgell tri...@samba.org
Autobuild-Date: Tue Oct 19 04:44:23 UTC 2010 on sn-devel-104

commit 75d57dbc25738bcf01d404b329fda22641a774ff
Author: Andrew Tridgell tri...@samba.org
Date:   Tue Oct 19 14:49:17 2010 +1100

selftest: terminate selftest if we can't setup the environment

---

Summary of changes:
 selftest/selftest.pl |5 +++--
 source4/dsdb/samdb/ldb_modules/objectclass.c |7 +++
 2 files changed, 10 insertions(+), 2 deletions(-)


Changeset truncated at 500 lines:

diff --git a/selftest/selftest.pl b/selftest/selftest.pl
index 7431bed..eabee7a 100755
--- a/selftest/selftest.pl
+++ b/selftest/selftest.pl
@@ -253,7 +253,7 @@ sub run_testsuite($)
if ($? == -1) {
Subunit::progress_pop();
Subunit::end_testsuite($name, error, Unable to run $cmd: 
$!);
-   return 0;
+   exit(1);
} elsif ($?  127) {
Subunit::end_testsuite($name, error,
sprintf(%s died with signal %d, %s coredump\n, $cmd, 
($?  127),  ($?  128) ? 'with' : 'without'));
@@ -953,7 +953,8 @@ $envvarstr
if (not defined($envvars)) {
Subunit::start_testsuite($name);
Subunit::end_testsuite($name, error,
-   unable to set up environment $envname);
+   unable to set up environment $envname - 
exiting);
+   exit(1);
next;
}
 
diff --git a/source4/dsdb/samdb/ldb_modules/objectclass.c 
b/source4/dsdb/samdb/ldb_modules/objectclass.c
index 02c3e46..c389965 100644
--- a/source4/dsdb/samdb/ldb_modules/objectclass.c
+++ b/source4/dsdb/samdb/ldb_modules/objectclass.c
@@ -1498,6 +1498,13 @@ static int objectclass_init(struct ldb_module *module)
/* Look for the opaque to indicate we might have to cut down the DN of 
defaultObjectCategory */
ldb_module_set_private(module, ldb_get_opaque(ldb, 
DSDB_EXTENDED_DN_STORE_FORMAT_OPAQUE_NAME));
 
+   ret = ldb_mod_register_control(module, LDB_CONTROL_RODC_DCPROMO_OID);
+   if (ret != LDB_SUCCESS) {
+   ldb_debug(ldb, LDB_DEBUG_ERROR,
+ objectclass_init: Unable to register control DCPROMO 
with rootdse\n);
+   return ldb_operr(ldb);
+   }
+
return ret;
 }
 


-- 
Samba Shared Repository