Fix bug #10010 - Missing integer wrap protection in EA list reading can cause server to loop with DOS.

Ensure we never wrap whilst adding client provided input.

Signed-off-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit c8d8bb257ac390c89c4238ed86dfef02750b6049)
Fix bug #10010 - Missing integer wrap protection in EA list reading can cause server to loop with DOS.

Fix client-side parsing also. Found by David Disseldorp <ddiss@suse.de>

Signed-off-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(master): Mon Aug  5 14:39:04 CEST 2013 on sn-devel-104
(cherry picked from commit c4cba824d9e4bb31e1b6a901e994ffdfd3ad522e)
dsdb-descriptor: Do not do a subtree search unless we have child entries

This avoids a subtree search here in most cases where an object is deleted.

Andrew Bartlett

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit 03b44d26fd17761675fe33ab29e8f325f59d8a5c)
dsdb: Rework subtree_rename module to use recursive LDB_SCOPE_ONELEVEL searches

This should be more efficient, particularly in the leaf node case when renaming and
deleting entries on large databases.

Andrew Bartlett

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit 31fb7f9c1b93b0f2114dec5096e43616ed317720)
dsdb-ridalloc: Rework ridalloc to return error strings where RID allocation fails

We now also only poke the RID manager once per request.

This may help track down why RID allocation can fail, as while we
never wait for the RID set to be created/updated, it may be the only
clue the admin gets as to why the async allocations were failing.

Andrew Bartlett

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit db9c3c62c89e1328872e3fdedde22b78770728a9)
selftest: Ensure the DC has started and and got a RID set before we proceed

This avoids errors when a busy DC has not yet fetched a RID set, showing up
as flapping tests when users are created, such as the samr.large-dc test.

Andrew Bartlett

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit ae0ba6bd833f71c4337ae3b6621bf797cb3c48c2)
dsdb: Add assert in drepl_take_FSMO_role

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit e9faf50ee123a8d1d647ebffa39107ca0dce756c)
rpc_server-drsuapi: Improve comments and DEBUG lines

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit 5e1f2795f28b0a213b4529e046edec68caa3bd41)
selftest: ensure samba4.rpc.samr.large-dc.two.samr.many is always tested

This test should now be more reliable with the over-allocation of
RID values now fixed.

Andrew Bartlett

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit 93b83151c9563f4c1f47b925fed079d275f8ec43)
dsdb/samdb: use RECYCLED it implies DELETED...

Signed-off-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit 63c05e820f1449b2dfa6e4f096d8270284a60bbb)
torture/drs: Expand an error message to aid debugging

Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Thu Jul 25 13:51:44 CEST 2013 on sn-devel-104
(cherry picked from commit a74c7d780cb6a1e8a5a63ebbbcf36fd7cf717ea1)
dsdb: Prune deleted objects of links and extra attributes of replicated deletes

When an object is deleted, the links to be removed are not propogated,
you have to watch out for them manually!

We do this by calling back into the originating update delete code (ie
what is called if you ldb_delete() locally) so that any extra
attribute found locally and not on the remote server becomes removed
remotely too.

We currently do the same with links, but that isn't strictly correct,
but for now our getNCChanges server code filters these out, so only
the usn is bumped.

Andrew Bartlett

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit d3aad891c5759f66bd891cb47866d908a0562a8a)
dsdb/repl_meta_data: split out replmd_deletion_state()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit a796cad90f1028ccc54a3539e34dc0728b990a96)
dsdb: Ensure we always force deleted objects back under the deleted objects DN

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit 32955a1dec3a97ab4550869dbeb5034247f3b1bc)

The last 12 patches address bug #10056 - dsdb improvements from 4.1.
dsdb: Improve DRS deleted link source/target handing in repl_meta_data

We now correctly ignore the link updates if the source or target is
deleted locally.

This fixes the long-standing failure in the vampire_dc dbcheck test.

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Andrew Bartlett

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit 0162be32ab4f9716a4300d1f1a0caae8b0133f7c)
dsdb tests: Add member/memberOf checking to delete_objects testing

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit a9e565a5a4478f7b923f35311e170de2044ff848)
dsdb: Include MS-ADTS doc references on deleted object contstraints

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit f2afdb61698c37389be286f9443471d4aeba49b8)
samba-tool dbcheck: Correctly remove deleted DNs in dbcheck

The previous pattern never matched, as it was a typo.

Andrew Bartlett

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Tue Jul 30 12:55:00 CEST 2013 on sn-devel-104
(cherry picked from commit 7615b2549d9549683978cb3e85b926e2ba63e294)

The last 4 patches address bug #9029 - Replication with --domain-crictical-only
fails to fill in backlinks.
security.idl: add new security_secinfo bits

[MS-DTYP].pdf 2.4.7

Signed-off-by: Gregor Beck <gbeck@sernet.de>
Fix bug 9678 - Windows 8 Roaming profiles fail

Windows 8 tries to set 'ATTRIBUTE_SECURITY_INFORMATION' on some
dirs. Ignoring it makes roaming profiles work again.
Just like w2k3 gracefully ignore all the other bits.

Signed-off-by: Gregor Beck <gbeck@sernet.de>