summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* WHATSNEW: entries for gnutls and samba-toolAndrew Bartlett2019-07-051-0/+30
| | | | | | | | Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Fri Jul 5 00:05:15 UTC 2019 on sn-devel-184
* s4/libnet: Fix joining a Windows pre-2008R2 DCTim Beale2019-07-041-0/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | From v4.8 onwards, Samba may not be able join a DC older than 2008R2 because the Windows DC doesn't support GET_TGT. If the dsdb repl_md code can't resolve a link target it returns an error, and the calling code (e.g. drs_util.py) should retry with GET_TGT. However, GET_TGT is only supported on Windows 2008R2 and later, so if you try to join an earlier Windows DC, the join will throw an error that you can't work-around. We can avoid this problem by setting the same DSDB flag that GET_TGT sets to indicate that the link targets are as up-to-date as possible, and so there's no point retrying. Missing targets are still logged, so this at least allows the admin to fix up any problems after the join completed. I've only done this for the join case (problems during periodic replication are probably still worth escalating to an error). BUG: https://bugzilla.samba.org/show_bug.cgi?id=14021 RN: From Samba v4.8 onwards, joining a Windows 2003 or 2008 (non-R2) AD DC may not have worked. When this problem occurred, the following message would be displayed: 'Failed to commit objects: DOS code 0x000021bf' This particular issue has now been resolved. Note that there may still be other potential problems that occur when joining an older Windows DC. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s3: smbd: SMB1 add range checks to reply_fclose().Jeremy Allison2019-07-041-0/+13
| | | | | | | | Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> Autobuild-User(master): Ralph Böhme <slow@samba.org> Autobuild-Date(master): Thu Jul 4 15:40:31 UTC 2019 on sn-devel-184
* s3: smbd: SMB1 add range checks to reply_search().Jeremy Allison2019-07-041-0/+10
| | | | | Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* vfs_nfs4acl_xattr: fix setting of permissions via NFSBjoern Jacke2019-07-041-31/+0
| | | | | | | | | via NFS root may not be priviledged user, so we should not call become_root() here. The normal NFS4 permissions already handle permission modify right, no need to do more magic things for Samba here. Signed-off-by: Bjoern Jacke <bjacke@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* smbd: Don't store num_read_oplocks in brlock.tdbVolker Lendecke2019-07-045-133/+6
| | | | | | | | | | | | | | This removes a kludgy implementation that worked around a locking hierarchy problem: Setting a byte range lock had to contend the level2 oplocks, which are stored in locking.tdb/leases.tdb. We could not access locking.tdb in the brlock.tdb code, as brlock.tdb might have been locked first without locking.tdb, violating the locking hierarchy locking.tdb->brlock.tdb. Now that that problem is gone (see the commit wrapping do_lock() in share_mode_do_locked()), we can remove this kludge. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* smbd: Use share_mode's flags in contend_level2_oplocksVolker Lendecke2019-07-041-116/+68
| | | | | | | | | | | | Here we traverse the oplocks and leases when breaking read leases. We find out here whether any of those are still left. As it's the receivers of the messages that downgrade the database entries, we might do that more than once. Possible future optimization? Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* smbd: Set SHARE_MODE_HAS_READ_LEASE when downgrading an oplockVolker Lendecke2019-07-041-0/+1
| | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* smbd: Set SHARE_MODE_HAS_READ_LEASE when granting a read leaseVolker Lendecke2019-07-041-0/+4
| | | | | | | | | | Lazy update of the flag: Whenever we add a read lease, we have to set the flag. Nobody except contend_level2_oplocks_begin will remove that flag again, as this would mean a full lease traverse when removing one. And contend_level2_oplocks_begin traverses the leases anyway Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* smbd: Add file_has_read_lease()Volker Lendecke2019-07-043-1/+73
| | | | | | | | This caches share_mode_data->flags in the fsp, cache flush happening on tdb_seqnum change. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* smbd: Add flags to the beginning of share_mode_dataVolker Lendecke2019-07-042-4/+11
| | | | | | | | | They are put at the beginning for easy parsing without reading the full struct. First step to remove the number of read oplocks/leases from brlock.tdb, where it does not belong. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* smbd: Send do_lock() through share_mode_do_locked()Volker Lendecke2019-07-041-23/+58
| | | | | | | | | | | | | | | | We need to maintain the locking hierarchy locking.tdb->brlock.tdb at all times. vfs_fruit directly calls do_lock(), which might fail to maintain the locking hierarchy: In brlock.c we call contend_level2_oplocks_begin(), which will soon look at the locking.tdb record. For the SMB1 and SMB2 callers we already have the share mode locked, we might want to watch that record for unlocks. For those callers share_mode_do_locked() is practically free to call, we share the underlying db_record. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* smbd: Add share_mode_do_locked()Volker Lendecke2019-07-042-2/+116
| | | | | | | | | | | | | | This is made for efficient locking of share mode records in locking.tdb. Right now we already need that when accessing leases.tdb, and soon it will be required for brlock.tdb as well. It does not give direct access to the parsed share mode entry, but the record is available for dbwrap_watched_wakeup() within downgrade_lease(). It can be freely nested with get_share_mode_lock calls, the record will be shared and proper nesting should be checked. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* smbd: Introduce static_share_mode_recordVolker Lendecke2019-07-041-22/+38
| | | | | | | | | | The next commit will introduce share_mode_do_locked(), which allocates a share mode record on the stack. We have to expect nested get_share_mode_lock() calls from within share_mode_do_locked() for which we need to share a db_record. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* smbd: Simplify share_mode_lock.cVolker Lendecke2019-07-041-157/+142
| | | | | | | | | | | | | | | | | | | Do explicit refcounting instead of talloc_reference(). A later patch will introduce a share_mode_do_locked() routine that can be nested arbitrarily with get_share_mode_lock(). To do sanity checks for proper nesting, share_mode_do_locked needs to be aware of the reference counts for "static_share_mode_lock". Why is share_mode_memcache_delete() gone? In parse_share_modes() we already move the data out of the cache, share_mode_lock_destructor() we don't even bother re-adding the share_mode_data to the cache if it does not have share entries, because the next opener will invent a new seqnum anyway. Also: Less talloc_reference(), less lines of code. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* dbwrap: Add publically available dbwrap_watch_wakeup()Volker Lendecke2019-07-042-0/+24
| | | | | | | | | | Without this, to notify watchers you need to actually store data. This might be a waste of resources. locking.tdb waiters might actually wait for leases.tdb or brlock.tdb changes, and locking.tdb records can be large. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* dbwrap: Rename dbwrap_watched_wakeup()Volker Lendecke2019-07-041-6/+7
| | | | | | | | In the next step I want to make dbwrap_watched_wakeup() publically available under that canonical name. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* WHATSNEW: add news the sad passing of python2 supportAndrew Bartlett2019-07-041-0/+19
| | | | | | | | Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Thu Jul 4 11:25:07 UTC 2019 on sn-devel-184
* WHATSNEW: add news about Samba AD at 100,000 scaleAndrew Bartlett2019-07-041-19/+75
| | | | | Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* WHATSNEW: ldb_batch mode and join performanceGary Lockyer2019-07-041-0/+13
| | | | | | | | Document the join performance improvement, and the ldb "batch_mode" option. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* domain join: set ldb "transaction_index_cache_size" optionGary Lockyer2019-07-041-7/+11
| | | | | | | | | Set the "transaction_index_cache_size" on a join to improve performance. These setting reduced a join to a 100k user domain from 105 minutes to 44 minutes. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* domain join: enable ldb batch modeGary Lockyer2019-07-042-6/+9
| | | | | | | | Enable ldb "batch_mode" transactions duting a join to improve performance. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* ldb: Release ldb 2.0.5ldb-2.0.5Gary Lockyer2019-07-043-1/+286
| | | | | | | | | | | | | | * add ldb_options_get add a function to get the options passed in ldb connect. * add "batch_mode" option. This options stops sub transactions being started for key value operations. It is intended to improve the performance in batch operations. As it bypasses the protections on operations if an operation fails, the entire transaction will be aborted by a commit. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* ldb: Rework index_transaction_cache_size to allow caller to specify a larger ↵Gary Lockyer2019-07-041-5/+11
| | | | | | | | | | size The previous code would override the caller with the DB size estimate rather than allowing the caller to force the bigger size. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* ldb ldb_key_value: test ldb batchGary Lockyer2019-07-041-0/+57
| | | | | | | Test the the ldb "batch_mode" option sets batch mode operation. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* ldb key_value: Add batch_mode optionGary Lockyer2019-07-042-0/+76
| | | | | | | | | | | | | | | | When performing a join the overhead of the sub transactions protecting key value operations becomes significant. This commit adds a new "batch_mode" option that disables the sub transactions around key value operations. The operation level index cache is also disabled, which means the overall transaction level index cache can become inconsistent if an operation fails. To protect against this and other possible on disk inconsistencies, if any operation fails during a batch_mode transaction the commit will fail and transaction will be rolled back. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4 samdb: pass ldb options to ldb_module_connect_backendGary Lockyer2019-07-041-1/+4
| | | | | | | | | Pass the ldb options into ldb_module_connect_backend, to ensure ldb options such as "batch mode" and "transaction index cache size" get passed through to the backend modules. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* ldb: Add new internal helper function ldb_options_get()Gary Lockyer2019-07-042-0/+12
| | | | | | | This is needed for modules to access the ldb->options array, as this in in ldb_private.h Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* ldb: Fix dependency on ldb_key_value_sub_txn_{mdb_}testAndrew Bartlett2019-07-041-2/+2
| | | | | | | | ldb_tdb can be a module, but the test is actually looking for ltdb_err_map() in ldb_tdb_err_map. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* ldb: Try to explain the confusing overload of the LDB_FLG_MOD_* enumeration ↵Andrew Bartlett2019-07-041-7/+11
| | | | | | | | | | and other flags Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Thu Jul 4 03:51:58 UTC 2019 on sn-devel-184
* ldb: Add tests for Ldb.write_ldif() including the FLG_SHOW_BINARY and ↵Andrew Bartlett2019-07-041-0/+51
| | | | | | | FLAG_FORCE_NO_BASE64_LDIF Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* pyldb: Apply flags specified by ldb.Ldb(flags=...) even if the URL is not setAndrew Bartlett2019-07-041-0/+2
| | | | | Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* doc: add documentation for "samba-tool" contact managementBjörn Baumbach2019-07-041-0/+186
| | | | | Signed-off-by: Björn Baumbach <bb@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* samba-tool tests: add tests for contact managementBjörn Baumbach2019-07-043-1/+485
| | | | | Signed-off-by: Björn Baumbach <bb@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* samba-tool: implement contact management commandsBjörn Baumbach2019-07-043-0/+785
| | | | | | | | | | | | | | | | | Usage: samba-tool contact <subcommand> Contact management. Available subcommands: create - Create a new contact. delete - Delete a contact. edit - Modify a contact. list - List all contacts. move - Move a contact object to an organizational unit or container. show - Display a contact. Signed-off-by: Björn Baumbach <bb@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* doc: add samba-tool group command to samba-tool man pageBjörn Baumbach2019-07-041-0/+15
| | | | | Signed-off-by: Björn Baumbach <bb@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* samba-tool tests: add test for 'samba-tool group edit' commandBjörn Baumbach2019-07-042-1/+210
| | | | | Signed-off-by: Björn Baumbach <bb@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* samba-tool group: add 'edit' command to edit an AD group objectBjörn Baumbach2019-07-041-0/+114
| | | | | | | Same like the samba-tool user edit command. Signed-off-by: Björn Baumbach <bb@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* samba-tool tests: add test for 'samba-tool computer edit' commandBjörn Baumbach2019-07-042-1/+182
| | | | | Signed-off-by: Björn Baumbach <bb@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* doc: add samba-tool computer command to samba-tool man pageBjörn Baumbach2019-07-041-0/+17
| | | | | Signed-off-by: Björn Baumbach <bb@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* samba-tool computer: add 'edit' command to edit an AD computer objectBjörn Baumbach2019-07-041-1/+122
| | | | | | | Similar to the samba-tool user edit command. Signed-off-by: Björn Baumbach <bb@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* samba-tool user edit: avoid base64 encoded strings in editable ldif if possibleBjörn Baumbach2019-07-043-3/+46
| | | | | | | | | | | Use clear text arguments strings if possible. Makes it more comfortable for users to edit the user objects attributes. Remove test from knownfail: samba.tests.samba_tool.user_edit.change_attribute_force_no_base64 Signed-off-by: Björn Baumbach <bb@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* samba-tool tests: add test for 'samba-tool user edit', using ↵Björn Baumbach2019-07-042-0/+27
| | | | | | | | | LDB_FLAG_FORCE_NO_BASE64_LDIF Test to edit a user: Change attributes with LDB_FLAG_FORCE_NO_BASE64_LDIF Signed-off-by: Björn Baumbach <bb@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* samba-tool user edit: simplify codeBjörn Baumbach2019-07-041-3/+1
| | | | | | | | Use "None"-changetype here, instead of "Add". This avoids the need to remove the changetype line afterwards. Signed-off-by: Björn Baumbach <bb@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* samba-tool user edit: use ldb methods to create ldif to modify userBjörn Baumbach2019-07-042-41/+13
| | | | | | | | | | | | Remove tests from knownfail: samba.tests.samba_tool.user_edit.add_attribute_base64 samba.tests.samba_tool.user_edit.add_attribute_base64_control samba.tests.samba_tool.user_edit.change_attribute_base64_control BUG: https://bugzilla.samba.org/show_bug.cgi?id=14003 Signed-off-by: Björn Baumbach <bb@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* samba-tool tests: add additional tests for "samba-tool user edit" commandBjörn Baumbach2019-07-042-0/+100
| | | | | | | | | | | | | | Especially test handling of base64 encoded attribute values here. Add selftest/knownfail.d/samba_tool.user_edit. Tests fail, because: - can not work with ldif without a trailing new line - can not handle base64 strings BUG: https://bugzilla.samba.org/show_bug.cgi?id=14003 Signed-off-by: Björn Baumbach <bb@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* ldb/ldb_ldif: add LDB_FLAG_FORCE_NO_BASE64_LDIF flagBjörn Baumbach2019-07-043-0/+11
| | | | | | | Flag is used to enforce binary encoded attribute values per attribute. Signed-off-by: Björn Baumbach <bb@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* ldb/ldb_ldif: add copy_raw_bytes helper variable to ldb_ldif_write_trace()Björn Baumbach2019-07-041-1/+3
| | | | | Signed-off-by: Björn Baumbach <bb@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* samba-tool user edit test: use testit instead of subunit_start_test, pass/failedBjörn Baumbach2019-07-041-38/+23
| | | | | Signed-off-by: Björn Baumbach <bb@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* samba-tool tests: remove probably outdated commentBjörn Baumbach2019-07-041-1/+0
| | | | | Signed-off-by: Björn Baumbach <bb@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
View Lorry Controller Status