summaryrefslogtreecommitdiff
path: root/source4
Commit message (Collapse)AuthorAgeFilesLines
* auth: Align integer typesVolker Lendecke2018-11-281-1/+1
| | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* krb5_wrap: Add a talloc_ctx to smb_krb5_principal_get_realm()Volker Lendecke2018-11-284-51/+32
| | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* CVE-2018-16857 dsdb/util: Add better default lockOutObservationWindowTim Beale2018-11-281-3/+7
| | | | | | | | | | | | | | | | Clearly the lockOutObservationWindow value is important, and using a default value of zero doesn't work very well. This patch adds a better default value (the domain default setting of 30 minutes). BUG: https://bugzilla.samba.org/show_bug.cgi?id=13683 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Karolin Seeger <kseeger@samba.org> Autobuild-Date(master): Wed Nov 28 11:31:14 CET 2018 on sn-devel-144
* CVE-2018-16857 dsdb/util: Fix lockOutObservationWindow for PSOsTim Beale2018-11-281-3/+3
| | | | | | | | | | Fix a remaining place where we were trying to read the msDS-LockoutObservationWindow as an int instead of an int64. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13683 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* CVE-2018-16857 dsdb/util: Correctly treat lockOutObservationWindow as 64-bit intTim Beale2018-11-281-5/+5
| | | | | | | | | | | | | | | | | Commit 442a38c918ae1666b35 refactored some code into a new get_lockout_observation_window() function. However, in moving the code, an ldb_msg_find_attr_as_int64() inadvertently got converted to a ldb_msg_find_attr_as_int(). ldb_msg_find_attr_as_int() will only work for values up to -2147483648 (about 3.5 minutes in MS timestamp form). Unfortunately, the automated tests used a low enough timeout that they still worked, however, password lockout would not work with the Samba default settings. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13683 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* CVE-2018-16857 tests: Sanity-check password lockout works with default valuesTim Beale2018-11-282-1/+35
| | | | | | | | | | | | | | | | Sanity-check that when we use the default lockOutObservationWindow that user lockout actually works. The easiest way to do this is to reuse the _test_login_lockout() test-case, but stop at the point where we wait for the lockout duration to expire (because we don't want the test to wait 30 mins). This highlights a problem currently where the default values don't work. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13683 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* CVE-2018-16853: fix crash in expired passowrd caseIsaac Boukris2018-11-281-3/+4
| | | | | | | | | | | When calling encode_krb5_padata_sequence() make sure to pass a null terminated array as required. Fixes expired passowrd case in samba4.blackbox.kinit test. Signed-off-by: Isaac Boukris <iboukris@gmail.com> Reviewed-by: Andreas Schneider <asn@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* CVE-2018-16853: Do not segfault if client is not setAndreas Schneider2018-11-281-0/+16
| | | | | | | | | This can be triggered with FAST but we don't support this yet. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13571 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* CVE-2018-16853: The ticket in check_policy_as can actually be a TGSIsaac Boukris2018-11-281-2/+6
| | | | | | | | | | | This happens when we are called from S4U2Self flow, and in that case kdcreq->client is NULL. Use the name from client entry instead. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13571 Signed-off-by: Isaac Boukris <iboukris@gmail.com> Reviewed-by: Andreas Schneider <asn@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* CVE-2018-16852 dcerpc dnsserver: refactor common properties handlingGary Lockyer2018-11-283-135/+104
| | | | | | | | | | | dnsserver_common.c and dnsutils.c both share similar code to process zone properties. This patch extracts the common code and moves it to dnsserver_common.c. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13669 Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* CVE-2018-16852 dcerpc dnsserver: Ensure properties are handled correctlyGary Lockyer2018-11-281-8/+56
| | | | | | | | | | | | | | | Fixes for Bug 13669 - (CVE-2018-16852) NULL pointer de-reference in Samba AD DC DNS management The presence of the ZONE_MASTER_SERVERS property or the ZONE_SCAVENGING_SERVERS property in a zone record causes the server to follow a null pointer and terminate. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13669 Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* CVE-2018-16852 dcerpc dnsserver: Verification testsGary Lockyer2018-11-283-2/+321
| | | | | | | | | | | | | | | Tests to verify Bug 13669 - (CVE-2018-16852) NULL pointer de-reference in Samba AD DC DNS management The presence of the ZONE_MASTER_SERVERS property or the ZONE_SCAVENGING_SERVERS property in a zone record causes the server to follow a null pointer and terminate. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13669 Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* CVE-2018-16851 ldap_server: Check ret before manipulating blobGarming Sam2018-11-281-2/+2
| | | | | | | | | | | | | | In the case of hitting the talloc ~256MB limit, this causes a crash in the server. Note that you would actually need to load >256MB of data into the LDAP. Although there is some generated/hidden data which would help you reach that limit (descriptors and RMD blobs). BUG: https://bugzilla.samba.org/show_bug.cgi?id=13674 Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* CVE-2018-16841 heimdal: Fix segfault on PKINIT with mis-matching principalAndrew Bartlett2018-11-281-3/+3
| | | | | | | | | | | | | In Heimdal KRB5_KDC_ERR_CLIENT_NAME_MISMATCH is an enum, so we tried to double-free mem_ctx. This was introduced in 9a0263a7c316112caf0265237bfb2cfb3a3d370d for the MIT KDC effort. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13628 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* CVE-2018-14629 dns: CNAME loop prevention using counterAaron Haslett2018-11-281-0/+6
| | | | | | | | | | | Count number of answers generated by internal DNS query routine and stop at 20 to match Microsoft's loop prevention mechanism. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13600 Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* dns: prevent self-referencing CNAMEAaron Haslett2018-11-281-0/+39
| | | | | | | | | | | Stops the user from adding a self-referencing CNAME over RPC, which is an easy mistake to make with samba-tool. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13600 Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* s3:selftest: add a VSS test reading a streamRalph Boehme2018-11-271-0/+87
| | | | | | | Bug: https://bugzilla.samba.org/show_bug.cgi?id=13455 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* s4:torture: add a test-suite for VSSRalph Boehme2018-11-272-0/+88
| | | | | | | | | | | | | | | This test will not be run from the main torture test runner in selftest, as there we don't pass the required arguments 'twrp_file' and 'twrp_snapshot'. The test needs a carefully prepared environment with provisioned snapshot data, so the test will be started from a blackbox test script. That comes next. Bug: https://bugzilla.samba.org/show_bug.cgi?id=13688 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* tests: Run backup tests against restoredc (SMBv1 disabled)Tim Beale2018-11-271-3/+8
| | | | | | | | | | | | | | | | | Running the backup tests against the restoredc highlights that the backup online/rename commands don't work if SMBv1 is disabled. Note that the offline commands still work because they don't rely on an SMB connection to the server. (Note that running the backup tests against the restoredc is probably a good idea anyway, to prove that there's no limit to the number of times you can restore a domain from backup, i.e. we support more than just a one-off restore). BUG: https://bugzilla.samba.org/show_bug.cgi?id=13676 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* tests: Use s3 smbclient for testenv smoketestsTim Beale2018-11-271-1/+1
| | | | | | | | | | | smbclient4 doesn't support SMBv2 connections, i.e. it won't work against a DC with SMBv1 disabled. The smoke-test here is that the DC accepts the connection, so we don't really care what SMB tool we use to connect. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13676 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* source4 smbd prefork: Add code commentsTim Beale2018-11-231-5/+46
| | | | | | | | | | Add some comments to the prefork code explaining what's going on. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Fri Nov 23 11:40:49 CET 2018 on sn-devel-144
* source4 dcerpc_server: remove irpc_add_nameGary Lockyer2018-11-231-2/+0
| | | | | | | | Remove the irpc_add_name from dcesrv_sock_accept, as it results in two identical names being registered for a process. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* source4 smbd prefork: Cleanup messaging on restartGary Lockyer2018-11-231-9/+95
| | | | | | | Clean up names registered in messaging for a terminated process. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* source4 messaging: clean up terminated processesGary Lockyer2018-11-232-0/+44
| | | | | | | | | Now that the smbd pre-fork process model restarts failed processes rather than terminating, we end up with names registered to defunct processes. This patch adds a function to clean up all the names registered to a process. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* source4 smbd prefork: Add backoff to process restartGary Lockyer2018-11-231-150/+227
| | | | | | | | | Add new smbd.conf variables 'prefork backoff increment' and 'prefork maximum backoff' to control the rate at which failed pre-forked processes are restarted. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* source4 smbd prefork: restart on non zero exit codeGary Lockyer2018-11-237-68/+119
| | | | | | | | Restart any pre-fork master or worker process that exits with a non zero exit code. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* source4 smbd process: pass the fatal flag to terminateGary Lockyer2018-11-236-4/+9
| | | | | | | | | | Pass the fatal flag supplied to task_server_terminate to the process task_terminate method. It will be used by the task_terminate methods to set an appropriate exit code. The process_prefork model will use a non zero exit code to indicate that the process should be restarted. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* source4 smbd prefork: Restart failed processesGary Lockyer2018-11-231-4/+71
| | | | | | | | Restart any pre-forked master or worker process that terminated with SIGABRT, SIGBUS, SIGFPE, SIGILL or SIGSYS Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* source4 smbd prefork: Pass restart informationGary Lockyer2018-11-231-47/+129
| | | | | | | | Pass information about the pre-fork master and worker processes that will allow them to be restarted. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* source4 smbd test: prefork process restartGary Lockyer2018-11-231-0/+10
| | | | | | | | Add tests for the restarting of failed/terminated process, by the pre-fork process model. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* replmd: remove unnecessary indentTim Beale2018-11-231-54/+53
| | | | | | | | | | | | | | | The previous refactor now means we return early if we don't need to re-apply isDeleted to the object. The 'else' is redundant and we can remove it to avoid unnecessary indent. This patch is basically just a whitespace change. It should not alter functionality. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Fri Nov 23 08:10:41 CET 2018 on sn-devel-144
* replmd: Move logic into new replmd_should_apply_isDeleted() functionTim Beale2018-11-231-7/+45
| | | | | | | | | | | | | | It's easier to follow the logic involved here when it's split out into a separate function. This patch should not alter the existing logic/functionality. Note the 'else' case is somewhat redundant, but it avoids excessive whitespace changes to the function. It'll be tidied up in the next patch. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* replmd: Avoid passing msg to replmd_process_linked_attribute()Tim Beale2018-11-231-18/+22
| | | | | | | | | | | | We can prevent anyone from inadvertently adding/removing msg->elements[] in replmd_process_linked_attribute() by just not passing msg into the function. Currently we only actually need the source DN and a memory context for reallocating old_el->values. The warning comment has been moved to a more appropriate place. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* tests: Fix flappiness in DRS tests due to RID Set changingTim Beale2018-11-231-2/+13
| | | | | | | | | | | | | | | | The test_link_utdv_hwm test case in getnc_exop has started getting slightly flappy (8 failures in the last 2 weeks). The problem is the test case creates a new computer, which can occasionally result in a new RID pool being allocated. The problem can be reproduced by running the test case repeatedly (it usually fails after ~250 times). This patch updates the _check_ctr6() assertion to filter out the 'CN=RID Set' object, if it happens to be present. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* tests: Add better error for DRS testsTim Beale2018-11-231-3/+3
| | | | | | | | | | | We've got a flappy test hitting this assertion failure, but we can't tell why it's failing intermittently (probably because we're bumping the RID-Set, but there's no way to confirm this). Add some extra debug info if the test assertion fails. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:torture: Initialize pointers in libnetapi user testAndreas Schneider2018-11-221-2/+2
| | | | | | | Found by Undefined Sanitizer. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* s4:bind_dlz: Only copy the dn onceAndreas Schneider2018-11-221-3/+4
| | | | | | | | | | | | | ../source4/dns_server/dlz_bind9.c:1132:4: error: 'dn' may be used uninitialized in this function [-Werror=maybe-uninitialized] state->log(ISC_LOG_INFO, "failed to find dnsRecord for %s", ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ldb_dn_get_linearized(dn)); ~~~~~~~~~~~~~~~~~~~~~~~~~~ Found by Undefined Sanitizer. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* replmd: Make replmd_process_linked_attribute() mem dependencies clearerTim Beale2018-11-211-6/+38
| | | | | | | | | | | | | | | | | | | | | | This patch should not alter functionality - it is just making memory assumptions used in replmd_process_linked_attribute() clearer. When adding/removing msg->elements we have to take care, as this will invalidate things like the parsed-DN array or old ldb_message_element pointers. This has always been the case (i.e. f6bc4c08b19f5615a49), however, now we need to take even more care, as the msg being modified is re-used and split across 2 different functions. Add more code comments to highlight this. We can also free pdn_list/old_el to prevent them being incorrectly used after realloc. It seems appropriate to also add a sanity-check that the tmp_ctx alloc succeeds (which all the other memory hangs off). Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Tim Beale <timbeale@samba.org> Autobuild-Date(master): Wed Nov 21 05:31:10 CET 2018 on sn-devel-144
* replmd: Avoid redundant dsdb_get_deleted_objects_dn() checksTim Beale2018-11-211-3/+12
| | | | | | | | | | | | | | | | Quite a bit of time was spent in dsdb_get_deleted_objects_dn() processing during either a join (~9%) or a full-sync (~28%). The problem is we're *always* doing the dsdb_get_deleted_objects_dn() call for each object, regardless of whether it's actually deleted or not. i.e. we were doing an expensive query and a lot of the time just ignoring the query result. If it's not a deleted object we're dealing with, we can just return early and skip the unnecessary processing. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* replmd: Minimize get_parsed_dns_trusted() calls during replicationTim Beale2018-11-211-10/+26
| | | | | | | | | | | | | | | | | | | | | | When a group has 10,000+ links, get_parsed_dns_trusted() can be costly (simply the talloc calls alone are expensive). Instead of re-generating the pdn_list for every single link attribute, we can change to only re-generate it when we really need to. When we add a new link, it reallocates old_el->values, and so we need to recreate the pdn_list because all the memory pointers will have changed. However, in the other cases, where we're simply updating the existing link value (or ignoring the update, if it's already applied), we can continue using the same pdn_list (rather than re-parsing it again). This would generally only save time with a full-sync - it won't really help with the join case (because every link processed results in a realloc). On a DB with 5000 users, this makes a full-sync about ~13% faster. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* replmd: Pass old_el into replmd_process_linked_attribute()Tim Beale2018-11-211-13/+15
| | | | | | | | | | | | | We should only need to lookup the msg attribute once per source object. The old_el->values may change due to link-processing, but old_el itself should not. This is not aimed at improving performance, but we need to change how old_el is used before we can change pdn_list (which is more costly processing-wise). Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* replmd: Remove some redundant codeTim Beale2018-11-211-5/+0
| | | | | | | | | | | | | | | At first glance, this code seemed completely unnecessary. However, it was added (by commit f6bc4c08b19f5615) for a valid reason: adding the whenChanged/uSNChanged attributes to the message can cause msg->elements to be reallocated, which means the old_el pointer (which points to msg->elements memory) can be out of date. whenChanged/uSNChanged now get added to the msg last, just before the DB modify operation. So old_el can no longer become out of date within replmd_process_link_attribute(), so re-fetching it is now redundant. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* replmd: Move where we update the usnChanged/whenChangedTim Beale2018-11-211-17/+22
| | | | | | | | | | | Move this closer to where the source object actually gets modified. The main reason to do this is that adding fields can cause the msg->elements to be reallocated, which will invalidate all the old_el and pdn_list pointers which are derived from the msg. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* replmd: Only modify the object if it actually changedTim Beale2018-11-211-0/+14
| | | | | | | | | | | | | | | | Commit 775054afbe1512 reworked replmd_process_link_attribute() so that we batch together DB operations for the same source object. However, it was possible that the object had not actually changed at all, e.g. - link was already processed by critical-objects-only during join, or - we were doing a full-sync and processing info that was already up-to-date in our DB. In these cases we modified the object anyway, even though nothing had changed. This patch fixes it up, so we check that the object has actually changed before modifying the DB. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* replmd: replmd_process_link_attribute() returns type of change madeTim Beale2018-11-211-2/+20
| | | | | | | | | | | | | | | | In order to share work across related link attribute updates, we need replmd_process_link_attribute() to let the caller know what actually changed. This patch adds an extra return type that'll be used in the next patch. What we're interested in is: the update was ignored (i.e. it's old news), a new link attribute was added (because this affects the overall msg/element memory), and an existing link attribute was modified (due to how links are actually stored, this includes deleting the link, as in reality it simply involves setting the existing link to 'inactive'). Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* source4 samr: Tidy DBG_WARNING callsGary Lockyer2018-11-211-49/+27
| | | | | | | | | | | | | | Move the calls to GUID_buf_string and dom_sid_str_buf into the coresponding DBG_WARNING call, instead of using an intermediate variable. While this violates the coding guidelines, doing this makes the code less cluttred and means the functions are only called if the debug message is printed. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Wed Nov 21 01:50:11 CET 2018 on sn-devel-144
* s4-samr: Use GUID_buf_string() in dcesrv_samr_EnumDomainUsers()Andrew Bartlett2018-11-201-2/+6
| | | | | | | | This avoids memory allocation. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* s4-samr: Use dom_sid_split_rid() to get the RID in dcesrv_samr_EnumDomainUsersAndrew Bartlett2018-11-201-5/+27
| | | | | | Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* source4 samr: cache samr_EnumDomainUsers resultsGary Lockyer2018-11-202-48/+156
| | | | | | | | | | | Add a cache of GUID's that matched the last samr_EnunDomainUsers made on a domain handle. The cache is cleared if resume_handle is zero, and when the final results are returned to the caller. The existing code repeated the database query for each chunk requested. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4-samr: Use GUID_buf_string() in dcesrv_samr_EnumDomainGroups()Andrew Bartlett2018-11-201-2/+6
| | | | | | | | This avoids memory allocation Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
View Lorry Controller Status