smbd: Fix memory overwrites

SIVAL writes 32 bit, not 16

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>

Autobuild-User(master): Michael Adam <obnox@samba.org>
Autobuild-Date(master): Fri Feb  7 20:07:23 CET 2014 on sn-devel-104

(cherry picked from commit 9088bde059e93a84745ec2158e2e640b5bb13844)

Fix bug #10415 - *** glibc detected *** /usr/sbin/smbd: free(): invalid next
size (fast).
Cope with first element in hdb_method having a different name in different heimdal versions.

It's called `interface_version` in older Heimdal versions and
`version` in newer versions.

Signed-off-by: Jelmer Vernooij <jelmer@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Thu Nov 28 04:17:55 CET 2013 on sn-devel-104

(cherry picked from commit 92489bfed4e6350b6858d5e39d538f41768912ae)
Support for Heimdal's unified krb5 and hdb plugin system.

Fixes exportkeytab and a kdc crash when building against heimdal master.

Bug-Debian: http://bugs.debian.org/732342

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jelmer Vernooij <jelmer@samba.org>
(cherry picked from commit 368208069e33a6d9b78a90f7326d5ac1bdd204f7)
kdc: Add belts-and-braces check that we fail if the hdb version changes

This checks both if host system run-time Heimdal has changed version,
and that the build-time version is supported.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-By: Jelmer Vernooij <jelmer@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Mon Jan 20 22:26:49 CET 2014 on sn-devel-104

(cherry picked from commit e758f4111356fafce5b5c8393648c9ea5c400601)

The last 3 patches address bug #10418 - INTERNAL ERROR: Signal 11 in the kdc
pid.
torture: add zero length FSCTL_SRV_COPYCHUNK test

Windows Server 2012 returns NT_STATUS_INVALID_PARAMETER for
FSCTL_SRV_COPYCHUNK requests that include a server-side copy length of
zero, in line with MS-SMB2 3.3.5.15.6.

We should match this behaviour, so test for it.

Signed-off-by: David Disseldorp <ddiss@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 54d07da81e181072b530e88b42d0d0d17fe60df0)
smbd/smb2_ioctl: fail zero length copy chunk requests

As documented in MS-SMB2 3.3.5.15.6 Handling a Server-Side Data Copy
Request, an invalid parameter response should be sent when:

The Length value in a single chunk is greater than
ServerSideCopyMaxChunkSize or *equal to zero*.

We do not currently abide by the latter part of this clause.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=10424

Signed-off-by: David Disseldorp <ddiss@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 00906f9604ad3e633e3d3cbc8d9dc4e2e305a455)
vfs_btrfs: pass-through copy-chunk(len=0) requests

Never map copy-chunk(len=0) requests to BTRFS_IOC_CLONE_RANGE ioctls. A
BTRFS_IOC_CLONE_RANGE with @src_length=0 results in a clone of all data
from @src_offset->EOF!

BUG: https://bugzilla.samba.org/show_bug.cgi?id=10424

Signed-off-by: David Disseldorp <ddiss@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 3be664969d4de41ebb4778caabce8bcf5e303064)
smbd: Fix an ancient oplock bug

If we get an oplock break response, we forgot to remove the oplock break
timeout.

Found by stopping raw.oplock.exclusive5 after the 2nd open and watching a debug
level 10 log. This amends 08a9de89 from 2007.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 0670975261c5f29394f9e9d25f899a7de948dad1)

Fix bug #10436 - cancel fsp->oplock_timeout in downgrade_file_oplock().
s3: vfs_dirsort module.

Allow dirsort to work when multiple simultaneous
directories are open. The old code only keeps one
active private data pointer on the connection struct, opening
a second directory on the same connection will overwrite it.

This modification turns the private data pointer
into a linked list of open directories on the
connection struct, and finds the correct one by searching
on the passed in DIR *.

With this code in place, smbd passes raw.search
torture test on a share definition with:

vfs objects = dirsort

https://bugzilla.samba.org/show_bug.cgi?id=10406

Signed-off-by: Jeremy Allison <jra@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit fd79652b0e598882e0c4d156bd897c29dae8ec04)
s3: vfs_dirsort module.

Add raw.search torture test on a share definition with:

vfs objects = dirsort

https://bugzilla.samba.org/show_bug.cgi?id=10406

Signed-off-by: Jeremy Allison <jra@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit 30cc8f41da58b87ff575860b7cde640520829923)
s3: modules: streaminfo: As we have no VFS function SMB_VFS_LLISTXATTR we can't cope with a symlink when lp_posix_pathnames() is true.

Fix bug : Bug 10429 - samba returns STATUS_OBJECT_NAME_NOT_FOUND when attempting to remove dangling symlink

https://bugzilla.samba.org/show_bug.cgi?id=10429

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Jeff Layton <jlayton@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Sat Feb  8 00:01:16 CET 2014 on sn-devel-104
(cherry picked from commit 17adbbcad7e401dd544dfa76f7ec9aeb6a847381)

Autobuild-User(v4-1-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-1-test): Fri Feb 14 22:30:55 CET 2014 on sn-devel-104
s3:smb2_notify: fix use after free on long living notify requests

This is a hack, but it should fix the bug:

   change_notify_add_request() talloc moves smb_request away,
   which is not expected by the smb2_notify.c code...

   smbd_smb2_notify_reply() uses tevent_req_defer_callback()
   (in older versions an immediate event) to defer the response.
   This is needed as change_notify_reply() will do more things
   after calling reply_fn() (smbd_smb2_notify_reply is this case)
   and often change_notify_remove_request() is called after
   change_notify_reply().

   change_notify_remove_request() implicitly free's the smb_request
   that was passed to change_notify_add_request().

   smbd_smb2_fake_smb_request() added the smb_request as smb2req->smb1req,
   which is expected to be available after smbd_smb2_notify_recv() returned.

The long term solution would be the following interface:

struct tevent_req *change_notify_request_send(TALLOC_CTX *mem_ctx,
                                              struct tevent_context *ev,
                                              struct files_struct *fsp,
                                              uint32_t max_length,
                                              uint32_t filter,
                                              bool recursive);
NTSTATUS change_notify_request_recv(struct tevent_req *req,
                                    TALLOC_CTX *mem_ctx,
                                    DATA_BLOB *buffer);

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10442

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Fri Feb 14 11:18:15 CET 2014 on sn-devel-104
(cherry picked from commit e0bf930f23fe20ee00d0006a5f6c2ba1a8f592a0)

Autobuild-User(v4-1-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-1-test): Sun Feb 16 19:14:12 CET 2014 on sn-devel-104
WHATSNEW: Add release notes for Samba 4.1.5.

Signed-off-by: Karolin Seeger <kseeger@samba.org>
VERSION: Disable git snapshots for the 4.1.5 release.

Signed-off-by: Karolin Seeger <kseeger@samba.org>
VERSION: Bump version number up to 4.1.6...

and re-enable git snapshots.

Signed-off-by: Karolin Seeger <kseeger@samba.org>
dfs: always call create_conn_struct with root privileges

This fixes a bug in dfs_samba4 identified by Daniel Müller.

create_conn_struct calls SMB_VFS_CONNECT which requires root privileges.
SMB_VFS_CONNECT in turn calls dfs_samba4_connect which connects to samdb.

Calls were made to this function without ever becoming root (notably via setup_dfs_referral)
which resulted in an error and the VFS connect failing. This happens when you have an active
directory domain controller with host msdfs = yes in smb.conf and dfs links in place.

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Bjoern Baumbach <bb@sernet.de>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Fri Jan 10 20:11:03 CET 2014 on sn-devel-104

(cherry picked from commit 24a687642de21ce872d25f16b3525003844d05f9)

Fix bug #10378 - dfs: always call create_conn_struct with root privileges.
librpc/nbt: increase MAX_COMPONENTS limit for nbt_names.

domains with more then 10 subdomains are not so uncommon.

https://bugzilla.samba.org/show_bug.cgi?id=10439

Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Thu Feb 13 16:30:50 CET 2014 on sn-devel-104

(cherry picked from commit 4e05bad0d18e351cb2a2db74860e77adea727c79)
Signed-off-by: Andreas Schneider <asn@samba.org>

Autobuild-User(v4-1-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-1-test): Fri Feb 21 13:19:27 CET 2014 on sn-devel-104