r16194: * Starting release notes for 3.0.23rc3 (later on).

* Pulling changes from SAMBA_3_0 r16193

8 files changed, 64 insertions, 27 deletions

diff --git a/WHATSNEW.txt b/WHATSNEW.txt
index 5cd72bd98af..51b6169fb6e 100644
--- a/WHATSNEW.txt
+++ b/WHATSNEW.txt
@@ -1,22 +1,50 @@
                    =================================
                    Release Notes for Samba 3.0.23rc2
-                              Jun 9, 2006
+                              Jun XX, 2006
                    =================================
 
-This is the second release candidate of the 3.0.23 code base and is 
+This is the third release candidate of the 3.0.23 code base and is 
 provided for testing purposes only.  While close to the final stable 
 release, this snapshot is *not* intended for production servers. 
 Your testing and feedback is greatly appreciated.
 
+Common issues addressed in 3.0.23rc3 include:
+
+   o 
+
+######################################################################
+Changes
+#######
+
+Changes since 3.0.23rc2
+-----------------------
+
+commits
+-------
+
+o   Guenther Deschner <gd@samba.org>
+    * Fix memleaks in winbindd ads searches.
+    * Fix timestamp bug in pam_winbindd which forced users to change
+      passwords prematurelty.
+
+
+Release Notes for older release follow:
+
+      --------------------------------------------------
+                   =================================
+                   Release Notes for Samba 3.0.23rc2
+                              Jun 9, 2006
+                   =================================
+
 Thanks very much to those people who spent time testing the RC1 
 release and reported their findings.  We would like to especially 
 thank Thomas Bork <tombork@web.de> for his numerous reports. 
 We believe that RC2 is in much better shape in a large part due 
 to his efforts.
 
-We would also like to thank the developers of Klokwork for their
+We would also like to thank the developers of Klocwork for their
 analysis of the Samba source tree.  This release candidate includes 
-multiple fixes based on reports from the Klokwork code analyzer.
+multiple fixes based on reports from the Klocwork code analyzer.
 
 Common issues addressed in 3.0.23rc2 include:
 
@@ -121,7 +149,7 @@ o   Volker Lendecke <vl@samba.org>
       'add machine script'.
     * Correct parsing error in parse_net.c for user's with no group
       membership.
-    * Fix off by one error in client SPNEGO code and other klokwork
+    * Fix off by one error in client SPNEGO code and other klocwork
       bug fixes.
 
 
diff --git a/packaging/RHEL/setup/filter-requires-samba.sh b/packaging/RHEL/setup/filter-requires-samba.sh
index 5545cf6c858..f90085ce359 100755
--- a/packaging/RHEL/setup/filter-requires-samba.sh
+++ b/packaging/RHEL/setup/filter-requires-samba.sh
@@ -1,4 +1,4 @@
 #!/bin/sh
 
-/usr/lib/rpm/perl.req $* | grep -E -v '(Net::LDAP|Crypt::SmbHash|CGI)'
+/usr/lib/rpm/perl.req $* | grep -E -v '(Net::LDAP|Crypt::SmbHash|CGI|Unicode::MapUTF8)'
 
diff --git a/packaging/RedHat-9/filter-requires-samba_rh8.sh b/packaging/RedHat-9/filter-requires-samba_rh8.sh
index 8428a6ad013..1fe7aca70ae 100755
--- a/packaging/RedHat-9/filter-requires-samba_rh8.sh
+++ b/packaging/RedHat-9/filter-requires-samba_rh8.sh
@@ -1,2 +1,3 @@
 #!/bin/sh
-/usr/lib/rpm/find-requires $* | egrep -v '(Net::LDAP|CGI)'
+
+/usr/lib/rpm/find-requires $* | grep -E -v '(Net::LDAP|Crypt::SmbHash|CGI|Unicode::MapUTF8)'
diff --git a/packaging/RedHat-9/filter-requires-samba_rh9.sh b/packaging/RedHat-9/filter-requires-samba_rh9.sh
index 5545cf6c858..f90085ce359 100755
--- a/packaging/RedHat-9/filter-requires-samba_rh9.sh
+++ b/packaging/RedHat-9/filter-requires-samba_rh9.sh
@@ -1,4 +1,4 @@
 #!/bin/sh
 
-/usr/lib/rpm/perl.req $* | grep -E -v '(Net::LDAP|Crypt::SmbHash|CGI)'
+/usr/lib/rpm/perl.req $* | grep -E -v '(Net::LDAP|Crypt::SmbHash|CGI|Unicode::MapUTF8)'
 
diff --git a/source/VERSION b/source/VERSION
index b2b78639071..a035c7f61d7 100644
--- a/source/VERSION
+++ b/source/VERSION
@@ -57,7 +57,7 @@ SAMBA_VERSION_PRE_RELEASE=
 # e.g. SAMBA_VERSION_RC_RELEASE=1                      #
 #  ->  "3.0.0rc1"                                      #
 ########################################################
-SAMBA_VERSION_RC_RELEASE=2
+SAMBA_VERSION_RC_RELEASE=3
 
 ########################################################
 # To mark SVN snapshots this should be set to 'yes'    #
diff --git a/source/libads/ldap.c b/source/libads/ldap.c
index 7b8b41b10a8..7fb5dac51bb 100644
--- a/source/libads/ldap.c
+++ b/source/libads/ldap.c
@@ -1213,9 +1213,10 @@ char *ads_default_ou_string(ADS_STRUCT *ads, const char *wknguid)
 	status = ads_search_dn(ads, &res, base, attrs);
 	if (!ADS_ERR_OK(status)) {
 		DEBUG(1,("Failed while searching for: %s\n", base));
+		SAFE_FREE(base);
 		return NULL;
 	}
-	free(base);
+	SAFE_FREE(base);
 
 	if (ads_count_replies(ads, res) != 1) {
 		return NULL;
@@ -1242,6 +1243,10 @@ char *ads_default_ou_string(ADS_STRUCT *ads, const char *wknguid)
 		free(s);
 	}
 
+	ads_memfree(ads, wkn_dn);
+	ldap_value_free(wkn_dn_exp);
+	ldap_value_free(bind_dn_exp);
+
 	return ret;
 }
 
diff --git a/source/nsswitch/winbindd_ads.c b/source/nsswitch/winbindd_ads.c
index f777b2ae18b..a8eb6f86d0d 100644
--- a/source/nsswitch/winbindd_ads.c
+++ b/source/nsswitch/winbindd_ads.c
@@ -723,7 +723,7 @@ static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
 	ADS_STATUS rc;
 	int count;
 	LDAPMessage *msg = NULL;
-	char *user_dn;
+	char *user_dn = NULL;
 	DOM_SID *sids;
 	int i;
 	DOM_SID primary_group;
@@ -791,9 +791,6 @@ static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
 
 	count = ads_pull_sids(ads, mem_ctx, msg, "tokenGroups", &sids);
 
-	if (msg) 
-		ads_msgfree(ads, msg);
-
 	/* there must always be at least one group in the token, 
 	   unless we are talking to a buggy Win2k server */
 
@@ -811,15 +808,16 @@ static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
 						    &primary_group,
 						    p_num_groups, user_sids);
 		if (NT_STATUS_IS_OK(status)) {
-			return status;
+			goto done;
 		}
 
 		/* lookup what groups this user is a member of by DN search on
 		 * "member" */
 
-		return lookup_usergroups_member(domain, mem_ctx, user_dn, 
-						&primary_group,
-						p_num_groups, user_sids);
+		status = lookup_usergroups_member(domain, mem_ctx, user_dn, 
+						  &primary_group,
+						  p_num_groups, user_sids);
+		goto done;
 	}
 
 	*user_sids = NULL;
@@ -844,6 +842,8 @@ static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
 	DEBUG(3,("ads lookup_usergroups (tokenGroups) succeeded for sid=%s\n",
 		 sid_to_string(sid_string, sid)));
 done:
+	ads_memfree(ads, user_dn);
+	ads_msgfree(ads, msg);
 	return status;
 }
 
@@ -885,7 +885,10 @@ static NTSTATUS lookup_groupmem(struct winbindd_domain *domain,
 		goto done;
 	}
 
-	sidstr = sid_binstring(group_sid);
+	if ((sidstr = sid_binstring(group_sid)) == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto done;
+	}
 
 	/* search for all members of the group */
 	if (!(ldap_exp = talloc_asprintf(mem_ctx, "(objectSid=%s)",sidstr))) {
diff --git a/source/nsswitch/winbindd_nss.h b/source/nsswitch/winbindd_nss.h
index 34e0d097219..2afefcc12ca 100644
--- a/source/nsswitch/winbindd_nss.h
+++ b/source/nsswitch/winbindd_nss.h
@@ -330,17 +330,17 @@ struct winbindd_response {
 				uint16 min_length_password;
 				uint16 password_history;
 				uint32 password_properties;
-				uint32 expire;
-				uint32 min_passwordage;
+				time_t expire;
+				time_t min_passwordage;
 			} policy;
 			uint32 reject_reason;
 			struct info3_text {
-				uint32 logon_time;
-				uint32 logoff_time;
-				uint32 kickoff_time;
-				uint32 pass_last_set_time;
-				uint32 pass_can_change_time;
-				uint32 pass_must_change_time;
+				time_t logon_time;
+				time_t logoff_time;
+				time_t kickoff_time;
+				time_t pass_last_set_time;
+				time_t pass_can_change_time;
+				time_t pass_must_change_time;
 				uint16 logon_count;
 				uint16 bad_pw_count;
 				uint32 user_rid;