summaryrefslogtreecommitdiff
path: root/source4/dsdb/repl
Commit message (Collapse)AuthorAgeFilesLines
* dsdb: Add log when ignoring a replicated object outside of partitionTim Beale2018-05-301-0/+6
| | | | | | | | | | | | | | This is probably a note-worthy event for debugging purposes. (Found while developing the domain rename functionality) Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz> Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Wed May 30 07:03:51 CEST 2018 on sn-devel-144
* s4-repl: Try to give more information in the error codes for prepare_commit ↵Andrew Bartlett2018-05-301-2/+3
| | | | | | | failure. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* samdb: Add remote address to connectGary Lockyer2018-05-101-1/+6
| | | | | Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* dsdb: Ensure to cancel the transaction if we fail to save the prefixMapAndrew Bartlett2018-04-121-0/+1
| | | | | | | This rare error case forgot to call ldb_transaction_cancel() Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* schema: Make writing indices flag an enum for a new stateGarming Sam2017-11-241-7/+7
| | | | | | | | | | In schema_load_init, we find that the writing of indices is not locked in any way. This leads to race conditions. To resolve this, we need to have a new state (SCHEMA_COMPARE) which can report to the caller that we need to open a transaction to write the indices. Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* dreplsrv: Use is_null_sidVolker Lendecke2017-11-131-3/+1
| | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* source4/smbd: refactor the process model for preforkGary Lockyer2017-10-191-1/+6
| | | | | | | | | | | | | | | | | | Refactor the process model code to allow the addition of a prefork process model. - Add a process context to contain process model specific state - Add a service details structure to allow service to indicate which process model options they can support. In the new code the services advertise the features they support to the process model. The process model context is plumbed through to allow the process model to keep track of the supported options, and any state the process model may require. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* debug: Add new debug class "drs_repl" for DRS replication processingAndrew Bartlett2017-09-0712-0/+36
| | | | | | | This is used in the client and in the server Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* replmd: Don't fail cycle if we get link for deleted object with GET_TGTTim Beale2017-08-181-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We are going to end up supporting 2 different server schemes: A. the old/default behaviour of sending all the linked attributes last, at the end of the replication cycle. B. the new/Microsoft way of sending the linked attributes interleaved with the source/target objects. Normally if we're talking to a server using the old scheme-A, we won't ever use the GET_TGT flag. However, there are a couple of cases where it can happen: - A link to a new object was added during the replication cycle. - An object was deleted while the replication was in progress (and the linked attribute got queued before the object was deleted). Talking to an Samba DC running the old scheme will just cause it to start the replication cycle from scratch again, which is fairly harmless. However, there is a chance that the same thing can happen again, in which case the replication cycle will fail (because GET_TGT was already set). Even if we're using the new scheme (B), we could still potentially hit this case, as we can still queue up linked attributes between requests (group memberships can be larger than what can fit into a single replication chunk). If GET_TGT is set in the GetNcChanges request, then the local copy of the target object should always be up-to-date when we process the linked attribute. So if we still think the target object is deleted/recycled at this point, then it's safe to ignore the linked attribute (because we know our local copy is up-to-date). This logic matches the MS spec logic in ProcessLinkValue(). Not failing the replication cycle may be beneficial if we're trying to do a full-sync of a large database. Otherwise it might be time-consuming and frustrating to repeat the sync unnecessarily. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Garming Sam <garming@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> BUG: https://bugzilla.samba.org/show_bug.cgi?id=12972
* drepl: Support GET_TGT on periodic replication clientTim Beale2017-08-183-17/+83
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Update IDL comments to include Microsoft reference doc - Add support for sending v10 GetNCChanges request (needed for the GET_TGT flag, which is in the new 'more_flags' field) - Update to also set the GET_TGT flag in the same place we were setting GET_ANC (I split this logic out into a separate function). - The state struct now needs to hold a 'more_flags' field as well (this flag is different to the GET_ANC replica flag) Note that using the GET_TGT when replicating from a Windows DC could be highly inefficient. Because Samba keeps the GET_TGT flag set throughout the replication cycle, it will basically receive a repeated object from Windows for every single linked attribute that it receives. I believe Windows behaviour only expects the client to set the GET_TGT flag when it actually needs to (i.e. when it receives a target object it doesn't know about), rather than throughout the replication cycle. However, this approach won't work with Samba-to-Samba replication, because when the server receives the GET_TGT flag it restarts the replication cycle from scratch. So if we only set the GET_TGT flag when the client encountered an unknown target then Samba-to-Samba could potentially get into an endless replication loop. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Garming Sam <garming@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> BUG: https://bugzilla.samba.org/show_bug.cgi?id=12972
* drs: Check target object is known after applying objectsTim Beale2017-08-181-4/+7
| | | | | | | | | | | | | | | | | Currently we only check that the target object is known at the end of the transaction (i.e. the .prepare_commit hook). It's too late at this point to resend the request with GET_TGT. Move this processing earlier on, after we've applied all the objects (i.e. off the .extended hook). In reality, we need to perform the checks at both points. I've split the common code that gets the source/target details out of the la_entry into a helper function. It's not the greatest function ever, but seemed to make more sense than duplicating the code. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Garming Sam <garming@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> BUG: https://bugzilla.samba.org/show_bug.cgi?id=12972
* drs: Fail replication transaction instead of dropping linksTim Beale2017-08-181-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If the DRS client received a linked attribute that it couldn't resolve the target for, then it would just ignore that link and keep going. That link would then be lost forever (although a full-sync would resolve this). Instead of silently ignoring the link, fail the transaction. This *can* happen on Samba, but it is unusual. The target object and linked-attribute would need to be added while a replication is still in progress. It can also happen fairly easily when talking to a Windows DC. There are two import exceptions to this: 1). Linked attributes that span partitions. We can never guarantee that we will have received the target object, because it may be in a partition we haven't replicated yet. Samba doesn't have a great way of handling this currently, but we shouldn't fail the replication (because that breaks basic join tests). Just skip that linked attribute and hope that a subsequent full-sync will fix it. (I queried Microsoft and they said resolving cross-partition linked attributes is a implementation-specific problem to solve. GET_TGT won't resolve it) 2). When the replication involves a subset of objects, e.g. critical-only. In these cases, we don't increase the highwater-mark, so it is probably not such a dire problem if we don't add the link. In the case of critical-only, we will do a subsequent full sync which will then add the links. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Garming Sam <garming@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> BUG: https://bugzilla.samba.org/show_bug.cgi?id=12972
* repl: Remove old TODOTim Beale2017-07-281-2/+0
| | | | | | | | | This TODO was added in 2007 before we supported linked attributes. It's no longer relevant. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4-drepl: Block GetNCChanges during a DsReplicaSyncAndrew Bartlett2017-07-231-1/+1
| | | | | | | | | | | | | | | | | | If we do not block these, we can get RPC faults (DCERPC_NCA_S_PROTO_ERROR) which gives WERR_WRITE_FAULT back to the DsReplicaSync call as there are two outstanding requests on the wire at the one time. We will get to the next operation as soon as this is finished when we call run_pending_ops(). BUG: https://bugzilla.samba.org/show_bug.cgi?id=12926 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Sun Jul 23 12:32:49 CEST 2017 on sn-devel-144
* s4-drepl: Use tevent_schedule_immediate() in DsReplicaSync handlerAndrew Bartlett2017-07-223-65/+24
| | | | | | | | | | | | | | | | | When we are sent a DsReplicaSync() we should work on inbound replication (ideally from the requested source, but so far we just start the whole queue) right away, not after 1 second. We should also target inbound replication, not any outbound replication notification that may happen to be due. BUG: https://bugzilla.samba.org/show_bug.cgi?id=12921 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Sat Jul 22 07:45:31 CEST 2017 on sn-devel-144
* dsdb: Improve debugging on start transacton failureAndrew Bartlett2017-07-021-1/+2
| | | | | Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* repl: Set GET_ALL_GROUP_MEMBERSHIP flag in the drepl serverGarming Sam2017-06-151-0/+14
| | | | | | | | | | | | Although we do not currently support this in the server, this will cause data loss against a Windows DC unless we set this flag as per the docs. This flag is required for the RODC. Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Garming Sam <garming@samba.org> Autobuild-Date(master): Thu Jun 15 05:31:59 CEST 2017 on sn-devel-144
* s4: Add TALLOC_CTX * to register_server_service().Jeremy Allison2017-05-111-1/+1
| | | | | | | | Use the passed in context from callers. Remove one talloc_autofree_context(). Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* lib: modules: Change XXX_init interface from XXX_init(void) to ↵Jeremy Allison2017-04-221-1/+1
| | | | | | | | | | | | | | | | | | | | XXX_init(TALLOC_CTX *) Not currently used - no logic changes inside. This will make it possible to pass down a long-lived talloc context from the loading function for modules to use instead of having them internally all use talloc_autofree_context() which is a hidden global. Updated all known module interface numbers, and added a WHATSNEW. Signed-off-by: Jeremy Allison <jra@samba.org> Signed-off-by: Ralph Böhme <slow@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Sat Apr 22 01:17:00 CEST 2017 on sn-devel-144
* drepl: Add partial attribute set in the case of repl secretGarming Sam2017-04-131-1/+1
| | | | | | | Against Windows, the call will always fail without it. Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* repl_secret: Error condition should sound harmlessGarming Sam2017-03-271-2/+8
| | | | | | | | In the case it is not in the replication group, it it correct to deny the replication to succeed. Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* Correct "successfuly" typos.Chris Lamb2017-02-221-1/+1
| | | | | | Signed-off-by: Chris Lamb <chris@chris-lamb.co.uk> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* Correct "enought" typo.Chris Lamb2017-02-221-1/+1
| | | | | | Signed-off-by: Chris Lamb <chris@chris-lamb.co.uk> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* s4:dsdb/repl: s/highestCommitedUsn/highestCommittedUSNStefan Metzmacher2017-02-081-1/+1
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* werror: replace WERR_NOMEM with WERR_NOT_ENOUGH_MEMORY in source4/dsdb/Günther Deschner2016-09-284-15/+15
| | | | | | | Guenther Signed-off-by: Guenther Deschner <gd@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* s4-dsdb: Change debug level for replicationAndreas Schneider2016-09-021-25/+26
| | | | | | | | | | | Most of the time it is spamming the logs, so increase the level to debug for most messages. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Fri Sep 2 05:06:00 CEST 2016 on sn-devel-144
* drepl_out: Send the prefix map alongside the global catalog partial ↵Garming Sam2016-08-251-2/+10
| | | | | | | attribute set Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* drepl_out: Send the prefix map alongside the RODC partial attribute setGarming Sam2016-08-251-4/+13
| | | | | Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* replicated_objects: Add missing newline for debugGarming Sam2016-08-251-2/+2
| | | | | Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:dsdb/repl: let dsdb_replicated_objects_convert() change remote to local ↵Stefan Metzmacher2016-08-111-5/+57
| | | | | | | | | | | | | attid for linked attributes We already do that for objects in dsdb_convert_object_ex(). We need to be consistent and do the same for linked attributes. BUG: https://bugzilla.samba.org/show_bug.cgi?id=12128 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* s4:dsdb/repl: set working_schema->resolving_in_progress during schema creationStefan Metzmacher2016-08-111-0/+3
| | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=12128 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* s4:dsdb/repl: make sure the working_schema prefix map is populated with the ↵Stefan Metzmacher2016-08-111-0/+35
| | | | | | | | | | | | | | remote prefix map We should create the working_schema prefix map before we try to resolve the schema. This allows getting the same mapping (if there's not already a conflict) and allows us to remove the implicit prefix mapping creation in the prefix mapping lookup functions. BUG: https://bugzilla.samba.org/show_bug.cgi?id=12128 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* s4:dsdb/repl: Improve memory handling in replicated schema codeAndrew Bartlett2016-08-111-4/+10
| | | | | | | | | This attempts to make it clear what memory is short term and what memory is long term BUG: https://bugzilla.samba.org/show_bug.cgi?id=12115 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* s4:dsdb/repl: avoid recursion after fetching schema changes.Stefan Metzmacher2016-08-112-17/+25
| | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=12115 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* s4: repl: Ensure all error paths in ↵Jeremy Allison2016-08-061-0/+4
| | | | | | | | | | | | dreplsrv_op_pull_source_get_changes_trigger() are protected with tevent returns. Otherwise dreplsrv_op_pull_source_get_changes_trigger() could infinitely recurse. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Michael Adam <obnox@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Sat Aug 6 01:24:05 CEST 2016 on sn-devel-144
* s4:dsdb/replicated_objects: don't skip notifications on resolved conflictsStefan Metzmacher2016-07-231-4/+16
| | | | | | | | | | We should propagate resolved conflicts immediately. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Sat Jul 23 03:18:58 CEST 2016 on sn-devel-144
* drepl: Fix a typoGarming Sam2016-07-211-1/+1
| | | | | Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* drs: pass the forced-replication flag from DsReplicaSync to GetNCChangesAndrew Bartlett2016-07-191-0/+4
| | | | | | | This ensures we and sync from a server with DISABLE_OUTBOUND_REPL set Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* repl: Remove check for parentGUID being NULL in dsdb_convert_object_ex()Andrew Bartlett2016-07-191-5/+0
| | | | | | | | | | We find that Windows 2012R2 sends a NULL parent_guid here, probably when no change to name is replicated. That is, if there has not been a rename, this is not required information, as we can just merge with the existing object, not matter where it is Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* dsdb: Fix CID 1363810: Null pointer dereferencesVolker Lendecke2016-07-131-3/+6
| | | | | | | | | | | The if-condition explicitly tests for new_schema==NULL, so this seems to be a valid error case. The DEBUG statement would segfault in this case. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Ira Cooper <ira@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Wed Jul 13 06:34:33 CEST 2016 on sn-devel-144
* dsdb: Remove 120 second delay and USN from schema refresh checkAndrew Bartlett2016-07-061-69/+11
| | | | | | | | | | | | | | | | | We now refresh it once the schema changes, so that replication can proceed right away. We use the sequence number in the metadata.tdb. The previous commit added a cache for this value, protected by tdb_seqnum(). metadata.tdb is now opened at startup to provide this support. Note that while still supported, schemaUpdateNow is essentially rudundent: instead, to ensure we increment the sequence number correctly, we unify that check into repl_meta_data at the transaction close. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* repl: Avoid use-after-free when working with the working_schemaAndrew Bartlett2016-06-071-1/+1
| | | | | | | | | | | | The original schema must live as long as the working_schema as the working_schema starts as a shallow-copy of schema. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz> BUG: https://bugzilla.samba.org/show_bug.cgi?id=11953 Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Tue Jun 7 14:33:39 CEST 2016 on sn-devel-144
* dsdb: Fix rename and RDN handling for replPropertyMetaDataAndrew Bartlett2016-06-071-64/+22
| | | | | | | | | | | | | | | This matches Windows 2012R2, which both has the RDN not sorted last and has it updated with the local invocation_id and a local version. The RDN attribute, unlike name, is not replicated over DRS, so the impact for interopability extends only to the incorrect RDN values that we were finding with dbcheck (values that did not match the name values). Finally, we always force the RDN to match the name attribute, which avoids issues in dbcheck where these diverge. As such, we can finally remove dbcheck as a flapping test, last re-added in e4bab3a8282d263eb2391bc7e8a6fd64ae068935 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* repl: Do not report all replication failures at level 0Andrew Bartlett2016-06-061-2/+7
| | | | | Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* dsdb: Clearly fail to replicate objects not NC_HEAD with a all-zero parentGUIDAndrew Bartlett2016-06-061-0/+5
| | | | | Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* repl: Enforce that we have parent objects for all replicated objectsAndrew Bartlett2016-06-062-16/+35
| | | | | | | | | The creating of replicated objects without their parent object allows database corruption as they can end up under the wrong object. We need to re-try the replication with the DRSUAPI_DRS_GET_ANC flag set to get the objects in tree order. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* repl: Retry replication of the schema on WERR_DS_DRA_SCHEMA_MISMATCHAndrew Bartlett2016-06-063-2/+109
| | | | | | | | | This makes us replicate the schema, and then go back to what we asked to replicate originally, when the schema changes. This should make the replication much more robust after schema changes Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* repl: Pass in the full partition DN to dsdb_replicated_objects_convert()Andrew Bartlett2016-06-062-7/+18
| | | | | | | | When we were processing an EXOP, we would pass in a DN specific to that operation, but this stopped repl_meta_data from finding the parent object Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* dsdb: Improve syntax clarityAndrew Bartlett2016-06-021-1/+2
| | | | | Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* dsdb/repl: Ensure we use the LOCAL attid value, not the remote oneAndrew Bartlett2016-03-131-4/+14
| | | | | | | | | | | | | | | | The key here is that while this never was an issue for builtin schema, nor for objects with an msDS-IntID used outside the schema partition, additional attributes added and used in the schema partition were incorrectly using the wrong attributeID value in the replPropertyMetaData. BUG: https://bugzilla.samba.org/show_bug.cgi?id=11783 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Sun Mar 13 23:29:14 CET 2016 on sn-devel-144