r6284: Starting on 3.0.14:

svn merge -r6016:6020 ../samba_3_0/
svn merge -r6034:6036 ../samba_3_0/
svn merge -r6060:6062 ../samba_3_0/
svn merge -r6062:6063 ../samba_3_0/
svn merge -r6110:6116 ../samba_3_0/
svn merge -r6152:6154 ../samba_3_0/
svn merge -r6157:6158 ../samba_3_0/
svn merge -r6163:6164 ../samba_3_0/
svn merge -r6167:6169 ../samba_3_0/
svn merge -r6174:6175 ../samba_3_0/
svn merge -r6175:6176 ../samba_3_0/
svn merge -r6204:6216 ../samba_3_0/
svn merge -r6216:6217 ../samba_3_0/
svn merge -r6232:6234 ../samba_3_0/
svn merge -r6234:6235 ../samba_3_0/
svn merge -r6242:6243 ../samba_3_0/
svn merge -r6255:6256 ../samba_3_0/
svn merge -r6279:6281 ../samba_3_0/

TO view the change log from SAMBA_3_0, run:

for rev in 6020 6036 6062 6063 6116 6154 6158 6164 6169 \
6175 6176 6216 6217 6234 6235 6243 6256 6281; do 
        svn log -r$rev svn://svnanon.samba.org/samba/branches/SAMBA_3_0 
done

17 files changed, 116 insertions, 41 deletions

diff --git a/packaging/Debian/debian-stable/changelog b/packaging/Debian/debian-stable/changelog
index 96f60fa1751..4a5d7201ec7 100644
--- a/packaging/Debian/debian-stable/changelog
+++ b/packaging/Debian/debian-stable/changelog
@@ -1,3 +1,15 @@
+samba (3.0.13-1) stable; urgency=high
+
+  * samba 3.0.13 release
+
+ -- Simo Sorce <idra@samba.org>  Sun, 27 March 2005 21:00:00 +0200
+
+samba (3.0.12-1) stable; urgency=low
+
+  * samba 3.0.12 release
+
+ -- Simo Sorce <idra@samba.org>  Sun, 20 March 2005 18:38:00 +0100
+
 samba (3.0.11-1) stable; urgency=low
 
   * samba 3.0.11 release
diff --git a/source/VERSION b/source/VERSION
index 41578401536..026b4553ff8 100644
--- a/source/VERSION
+++ b/source/VERSION
@@ -19,7 +19,7 @@
 ########################################################
 SAMBA_VERSION_MAJOR=3
 SAMBA_VERSION_MINOR=0
-SAMBA_VERSION_RELEASE=13
+SAMBA_VERSION_RELEASE=14
 
 ########################################################
 # For 'pre' releases the version will be               #
diff --git a/source/configure.in b/source/configure.in
index 7338b879eea..f81d7fbb17d 100644
--- a/source/configure.in
+++ b/source/configure.in
@@ -235,6 +235,16 @@ AC_ARG_ENABLE(debug,
 	CFLAGS="${CFLAGS} -g"
     fi])
 
+# compile with optimization and without debugging by default, but
+# allow people to set their own preference.
+# do this here since AC_CACHE_CHECK apparently sets the CFLAGS to "-g -O2"
+# if it has no value.  This prevent *very* large debug binaries from occurring
+# by default.
+if test "x$CFLAGS" = x; then
+  CFLAGS="-O"
+fi
+
+
 AC_ARG_ENABLE(developer, [  --enable-developer      Turn on developer warnings and debugging (default=no)],
     [if eval "test x$enable_developer = xyes"; then
         developer=yes
@@ -293,13 +303,6 @@ AC_PATH_PROG(PERL, perl)
 
 AC_CHECK_TOOL(AR, ar)
 
-# compile with optimization and without debugging by default, but
-# allow people to set their own preference.
-if test "x$CFLAGS" = x
-then
-  CFLAGS="-O ${CFLAGS}"
-fi
-
 dnl Check if we use GNU ld
 LD=ld
 AC_PROG_LD_GNU
diff --git a/source/nsswitch/winbindd_cm.c b/source/nsswitch/winbindd_cm.c
index dc2d6cfc6f6..832672e64cb 100644
--- a/source/nsswitch/winbindd_cm.c
+++ b/source/nsswitch/winbindd_cm.c
@@ -102,11 +102,11 @@ static void cm_get_ipc_userpass(char **username, char **domain, char **password)
 		if (!*password || !**password)
 			*password = smb_xstrdup("");
 
-		DEBUG(3, ("IPC$ connections done by user %s\\%s\n", 
+		DEBUG(3, ("cm_get_ipc_userpass: Retrieved auth-user from secrets.tdb [%s\\%s]\n", 
 			  *domain, *username));
 
 	} else {
-		DEBUG(3, ("IPC$ connections done anonymously\n"));
+		DEBUG(3, ("cm_get_ipc_userpass: No auth-user defined\n"));
 		*username = smb_xstrdup("");
 		*domain = smb_xstrdup("");
 		*password = smb_xstrdup("");
@@ -376,7 +376,11 @@ static NTSTATUS cm_prepare_connection(const struct winbindd_domain *domain,
 	got_mutex = False;
 	*retry = False;
 
-	if (domain->primary || IS_DC) {
+	/* Windows 2003 SP1 does not lie LsaOpenPolicy() over schannel.
+	   Returns RPC_NT_CANNOT_SUPPPORT (0xc0020041) for that call.
+	   So just drop it on the lsarpc pipe */
+
+	if ( (domain->primary || IS_DC) && (pipe_index!=PI_LSARPC) ) {
 		NTSTATUS status = setup_schannel( *cli, domain->name );
 		if (!NT_STATUS_IS_OK(status)) {
 			DEBUG(3,("schannel refused - continuing without "
diff --git a/source/nsswitch/winbindd_group.c b/source/nsswitch/winbindd_group.c
index 1af9daae46e..51618bd00fd 100644
--- a/source/nsswitch/winbindd_group.c
+++ b/source/nsswitch/winbindd_group.c
@@ -857,6 +857,10 @@ enum winbindd_result winbindd_list_groups(struct winbindd_cli_state *state)
 		   
 		if ( *which_domain && !strequal(which_domain, domain->name) )
 			continue;
+
+		if ( !domain->initialized )
+			set_dc_type_and_flags( domain );
+
 			
 		ZERO_STRUCT(groups);
 
@@ -1047,6 +1051,13 @@ enum winbindd_result winbindd_getgroups(struct winbindd_cli_state *state)
 
 	if ( !opt_nocache && (info3 = netsamlogon_cache_get(mem_ctx, &user_sid))) {
 
+		struct winbindd_domain *our_domain = find_our_domain();
+
+		if (our_domain == NULL) {
+			DEBUG(0, ("Could not find our domain\n"));
+			goto done;
+		}
+
 		DEBUG(10, ("winbindd_getgroups: info3 has %d groups, %d other sids\n",
 			   info3->num_groups2, info3->num_other_sids));
 
@@ -1055,6 +1066,7 @@ enum winbindd_result winbindd_getgroups(struct winbindd_cli_state *state)
 		/* Go through each other sid and convert it to a gid */
 
 		for (i = 0; i < info3->num_other_sids; i++) {
+			DOM_SID *sid = &info3->other_sids[i].sid;
 			fstring name;
 			fstring dom_name;
 			enum SID_NAME_USE sid_type;
@@ -1062,30 +1074,30 @@ enum winbindd_result winbindd_getgroups(struct winbindd_cli_state *state)
 			/* Is this sid known to us?  It can either be
                            a trusted domain sid or a foreign sid. */
 
-			if (!winbindd_lookup_name_by_sid( &info3->other_sids[i].sid, 
-				dom_name, name, &sid_type))
-			{
-				DEBUG(10, ("winbindd_getgroups: could not lookup name for %s\n", 
-					   sid_string_static(&info3->other_sids[i].sid)));
+			if (!winbindd_lookup_name_by_sid( sid, dom_name,
+							  name, &sid_type)) {
+				DEBUG(10, ("winbindd_getgroups: could not "
+					   "lookup name for %s\n", 
+					   sid_string_static(sid)));
 				continue;
 			}
 
-			/* Check it is a domain group or an alias (domain local group) 
-			   in a win2k native mode domain. */
+			/* Check it is a domain group or an alias (domain
+			   local group) in a win2k native mode domain. */
 			
-			if ( !((sid_type==SID_NAME_DOM_GRP) ||
-				((sid_type==SID_NAME_ALIAS) && domain->primary)) )
-			{
+			if (!((sid_type==SID_NAME_DOM_GRP) ||
+			      ((sid_type==SID_NAME_ALIAS) &&
+			       (our_domain->active_directory) &&
+			       (our_domain->native_mode) &&
+			       (sid_compare_domain(sid, &our_domain->sid)
+				== 0)))) {
 				DEBUG(10, ("winbindd_getgroups: sid type %d "
 					   "for %s is not a domain group\n",
-					   sid_type,
-					   sid_string_static(
-						   &info3->other_sids[i].sid)));
+					   sid_type, sid_string_static(sid)));
 				continue;
 			}
 
-			add_gids_from_group_sid(&info3->other_sids[i].sid,
-						&gid_list, &num_gids);
+			add_gids_from_group_sid(sid, &gid_list, &num_gids);
 		}
 
 		for (i = 0; i < info3->num_groups2; i++) {
@@ -1255,8 +1267,8 @@ enum winbindd_result winbindd_getusersids(struct winbindd_cli_state *state)
 		user_grpsids[num_groups] = &user_sid;
 
 		status = domain->methods->lookup_useraliases(domain, mem_ctx,
-							     num_groups,
-							     user_grpsids+1,
+							     num_groups+1,
+							     user_grpsids,
 							     &num_aliases,
 							     &alias_rids);
 
diff --git a/source/nsswitch/winbindd_user.c b/source/nsswitch/winbindd_user.c
index fc3fe0f9631..e879275c632 100644
--- a/source/nsswitch/winbindd_user.c
+++ b/source/nsswitch/winbindd_user.c
@@ -606,6 +606,9 @@ enum winbindd_result winbindd_list_users(struct winbindd_cli_state *state)
 		   
 		if ( *which_domain && !strequal(which_domain, domain->name) )
 			continue;
+
+		if ( !domain->initialized )
+			set_dc_type_and_flags( domain );
 			
 		methods = domain->methods;
 
diff --git a/source/rpc_parse/parse_rpc.c b/source/rpc_parse/parse_rpc.c
index f4ffcba1bdf..aa296eb70a1 100644
--- a/source/rpc_parse/parse_rpc.c
+++ b/source/rpc_parse/parse_rpc.c
@@ -381,6 +381,9 @@ void init_rpc_hdr_rb(RPC_HDR_RB *rpc,
 
 BOOL smb_io_rpc_hdr_rb(const char *desc, RPC_HDR_RB *rpc, prs_struct *ps, int depth)
 {
+	RPC_HDR_RB rpc2;
+	int i;
+	
 	if (rpc == NULL)
 		return False;
 
@@ -401,6 +404,20 @@ BOOL smb_io_rpc_hdr_rb(const char *desc, RPC_HDR_RB *rpc, prs_struct *ps, int de
 		return False;
 	if(!smb_io_rpc_iface("", &rpc->transfer, ps, depth))
 		return False;
+		
+	/* just chew through extra context id's for now */
+	
+	for ( i=1; i<rpc->num_elements; i++ ) {
+		if(!prs_uint16("context_id  ", ps, depth, &rpc2.context_id ))
+			return False;
+		if(!prs_uint8 ("num_syntaxes", ps, depth, &rpc2.num_syntaxes))
+			return False;
+
+		if(!smb_io_rpc_iface("", &rpc2.abstract, ps, depth))
+			return False;
+		if(!smb_io_rpc_iface("", &rpc2.transfer, ps, depth))
+			return False;
+	}	
 
 	return True;
 }
diff --git a/source/smbd/dir.c b/source/smbd/dir.c
index 1ec35d839c2..309f4adf478 100644
--- a/source/smbd/dir.c
+++ b/source/smbd/dir.c
@@ -573,8 +573,6 @@ const char *dptr_ReadDirName(struct dptr_struct *dptr, long *poffset, SMB_STRUCT
 		}
 	}
 
-	dptr->has_wild = True;
-
 	/* In case sensitive mode we don't search - we know if it doesn't exist 
 	   with a stat we will fail. */
 
@@ -584,6 +582,7 @@ const char *dptr_ReadDirName(struct dptr_struct *dptr, long *poffset, SMB_STRUCT
 		dptr->dir_hnd->offset = *poffset = -1;
 		return NULL;
 	} else {
+		dptr->has_wild = True;
 		return dptr_normal_ReadDirName(dptr, poffset, pst);
 	}
 }
@@ -602,7 +601,7 @@ BOOL dptr_SearchDir(struct dptr_struct *dptr, const char *name, long *poffset, S
 		return False;
 	}
 
-	while (SearchDir(dptr->dir_hnd, name, poffset) == True) {
+	if (SearchDir(dptr->dir_hnd, name, poffset)) {
 		if (is_visible_file(dptr->conn, dptr->path, name, pst, True)) {
 			return True;
 		}
diff --git a/source/smbd/oplock.c b/source/smbd/oplock.c
index a55d5443d56..b9e38e30fcc 100644
--- a/source/smbd/oplock.c
+++ b/source/smbd/oplock.c
@@ -808,6 +808,12 @@ static BOOL oplock_break(SMB_DEV_T dev, SMB_INO_T inode, unsigned long file_id,
 	saved_vuid = current_user.vuid;
 	saved_fsp_conn = fsp->conn;
 	change_to_root_user();
+	/*
+	 * Initialize saved_dir to something sensible: vfs_GetWd may not work well
+	 * for root: the directory may be NFS-mounted and exported with root_squash
+	 * (so has no root access).
+	 */
+	pstrcpy(saved_dir,saved_fsp_conn->connectpath);
 	vfs_GetWd(saved_fsp_conn,saved_dir);
 	/* Save the chain fnum. */
 	file_chain_save();
diff --git a/source/smbd/reply.c b/source/smbd/reply.c
index d7fe5cd98f1..5802720b7e9 100644
--- a/source/smbd/reply.c
+++ b/source/smbd/reply.c
@@ -980,7 +980,10 @@ int reply_search(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
 
 	if (Protocol >= PROTOCOL_NT1)
 		SSVAL(outbuf,smb_flg2,SVAL(outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
-  
+
+	/* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
+	SSVAL(outbuf,smb_flg2, (SVAL(outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
+	  
 	outsize += DIR_STRUCT_SIZE*numentries;
 	smb_setlen(outbuf,outsize - 4);
   
diff --git a/source/smbd/sesssetup.c b/source/smbd/sesssetup.c
index 40ea28a86d5..19acc4b1b08 100644
--- a/source/smbd/sesssetup.c
+++ b/source/smbd/sesssetup.c
@@ -673,6 +673,10 @@ int reply_sesssetup_and_X(connection_struct *conn, char *inbuf,char *outbuf,
 
 	if (Protocol < PROTOCOL_NT1) {
 		uint16 passlen1 = SVAL(inbuf,smb_vwv7);
+
+		/* Never do NT status codes with protocols before NT1 as we don't get client caps. */
+		remove_from_common_flags2(FLAGS2_32_BIT_ERROR_CODES);
+
 		if ((passlen1 > MAX_PASS_LEN) || (passlen1 > smb_bufrem(inbuf, smb_buf(inbuf)))) {
 			return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
 		}
diff --git a/source/smbd/vfs.c b/source/smbd/vfs.c
index 34671b8efc6..28441c91abc 100644
--- a/source/smbd/vfs.c
+++ b/source/smbd/vfs.c
@@ -731,7 +731,9 @@ char *vfs_GetWd(connection_struct *conn, char *path)
 		in trouble :-) */
 
 	if (SMB_VFS_STAT(conn, ".",&st) == -1) {
-		DEBUG(0,("Very strange, couldn't stat \".\" path=%s\n", path));
+		/* Known to fail for root: the directory may be
+		 * NFS-mounted and exported with root_squash (so has no root access). */
+		DEBUG(1,("vfs_GetWd: couldn't stat \".\" path=%s error %s (NFS problem ?)\n", path, strerror(errno) ));
 		return(SMB_VFS_GETWD(conn,path));
 	}
 
diff --git a/source/tdb/tdb.c b/source/tdb/tdb.c
index b3d596f4428..f66e50afe46 100644
--- a/source/tdb/tdb.c
+++ b/source/tdb/tdb.c
@@ -832,9 +832,14 @@ static int tdb_expand(TDB_CONTEXT *tdb, tdb_off size)
 
 	tdb->map_size += size;
 
-	if (tdb->flags & TDB_INTERNAL)
-		tdb->map_ptr = realloc(tdb->map_ptr, tdb->map_size);
-	else {
+	if (tdb->flags & TDB_INTERNAL) {
+		char *new_map_ptr = realloc(tdb->map_ptr, tdb->map_size);
+		if (!new_map_ptr) {
+			tdb->map_size -= size;
+			goto fail;
+		}
+		tdb->map_ptr = new_map_ptr;
+	} else {
 		/*
 		 * We must ensure the file is remapped before adding the space
 		 * to ensure consistency with systems like OpenBSD where
diff --git a/source/torture/t_strstr.c b/source/torture/t_strstr.c
index 25709526fe8..7b928fb26be 100644
--- a/source/torture/t_strstr.c
+++ b/source/torture/t_strstr.c
@@ -11,7 +11,7 @@ int main(int argc, char *argv[])
 	int i;
 	int iters = 1;
 	
-	char *ret;
+	const char *ret = NULL;
 
 	/* Needed to initialize character set */
 	lp_load("/dev/null", True, False, False);
@@ -29,6 +29,9 @@ int main(int argc, char *argv[])
 		ret = strstr_m(argv[1], argv[2]);
 	}
 
+	if (ret == NULL)
+		ret = "(null)";
+
 	printf("%s\n", ret);
 	
 	return 0;
diff --git a/source/torture/torture.c b/source/torture/torture.c
index 37aefc55acf..b37a30cf2e3 100644
--- a/source/torture/torture.c
+++ b/source/torture/torture.c
@@ -537,7 +537,7 @@ static BOOL rw_torture2(struct cli_state *c1, struct cli_state *c2)
 static BOOL run_readwritetest(int dummy)
 {
 	static struct cli_state *cli1, *cli2;
-	BOOL test1, test2;
+	BOOL test1, test2 = False;
 
 	if (!torture_open_connection(&cli1) || !torture_open_connection(&cli2)) {
 		return False;
diff --git a/source/utils/smbpasswd.c b/source/utils/smbpasswd.c
index 90c3ce4d2e2..836a161021d 100644
--- a/source/utils/smbpasswd.c
+++ b/source/utils/smbpasswd.c
@@ -282,7 +282,7 @@ static BOOL password_change(const char *remote_mach, char *username,
 		ret = remote_password_change(remote_mach, username, 
 					     old_passwd, new_pw, err_str, sizeof(err_str));
 		if(*err_str)
-			fprintf(stderr, err_str);
+			fprintf(stderr, "%s", err_str);
 		return ret;
 	}
 	
@@ -292,7 +292,7 @@ static BOOL password_change(const char *remote_mach, char *username,
 	if(*msg_str)
 		printf(msg_str);
 	if(*err_str)
-		fprintf(stderr, err_str);
+		fprintf(stderr, "%s", err_str);
 
 	return ret;
 }
@@ -503,7 +503,7 @@ static int process_nonroot(int local_flags)
 			fstrcpy(user_name,pwd->pw_name);
 			passwd_free(&pwd);
 		} else {
-			fprintf(stderr, "smbpasswd: you don't exist - go away\n");
+			fprintf(stderr, "smbpasswd: cannot lookup user name for uid %u\n", (unsigned int)getuid());
 			exit(1);
 		}
 	}
diff --git a/source/web/diagnose.c b/source/web/diagnose.c
index a4907860685..85e710cee8f 100644
--- a/source/web/diagnose.c
+++ b/source/web/diagnose.c
@@ -21,6 +21,8 @@
 #include "includes.h"
 #include "web/swat_proto.h"
 
+extern struct in_addr loopback_ip;
+
 #ifdef WITH_WINBIND
 
 NSS_STATUS winbindd_request(int req_type,