Changeset 988 for vendor/current/source3/libnet

Timestamp:

Nov 24, 2016, 1:14:11 PM (9 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: update vendor to version 4.4.3

Location:

vendor/current/source3/libnet

Files:

• libnet_dssync.c (modified) (8 diffs)
• libnet_dssync_keytab.c (modified) (4 diffs)
• libnet_dssync_passdb.c (modified) (38 diffs)
• libnet_join.c (modified) (60 diffs)
• libnet_join.h (modified) (1 diff)
• libnet_keytab.c (modified) (1 diff)
• libnet_keytab.h (modified) (1 diff)
• libnet_samsync.c (modified) (8 diffs)
• libnet_samsync.h (modified) (1 diff)
• libnet_samsync_display.c (modified) (1 diff)
• libnet_samsync_ldif.c (modified) (21 diffs)
• libnet_samsync_passdb.c (modified) (14 diffs)
• netapi.pc.in (added)

vendor/current/source3/libnet/libnet_dssync.c

@@ -55 +55 @@
         struct dssync_context *ctx;
 
-        ctx = TALLOC_ZERO_P(mem_ctx, struct dssync_context);
+        ctx = talloc_zero(mem_ctx, struct dssync_context);
         NT_STATUS_HAVE_NO_MEMORY(ctx);
 
@@ -114 +114 @@
                                                   session_key,
                                                   rid,
+                                                  0,
                                                   attr);
                 }
@@ -196 +197 @@
                 break;
         }
-        case 28:
+        case 28: {
                 ctx->remote_info28 = bind_info.info.info28;
                 break;
+        }
+        case 32: {
+                struct drsuapi_DsBindInfo32 *info32;
+                info32 = &bind_info.info.info32;
+                ctx->remote_info28.site_guid            = info32->site_guid;
+                ctx->remote_info28.supported_extensions = info32->supported_extensions;
+                ctx->remote_info28.pid                  = info32->pid;
+                ctx->remote_info28.repl_epoch           = info32->repl_epoch;
+                break;
+        }
         case 48: {
                 struct drsuapi_DsBindInfo48 *info48;
@@ -206 +217 @@
                 ctx->remote_info28.pid                  = info48->pid;
                 ctx->remote_info28.repl_epoch           = info48->repl_epoch;
+                break;
+        }
+        case 52: {
+                struct drsuapi_DsBindInfo52 *info52;
+                info52 = &bind_info.info.info52;
+                ctx->remote_info28.site_guid            = info52->site_guid;
+                ctx->remote_info28.supported_extensions = info52->supported_extensions;
+                ctx->remote_info28.pid                  = info52->pid;
+                ctx->remote_info28.repl_epoch           = info52->repl_epoch;
                 break;
         }
@@ -340 +360 @@
         }
 
-        nc = TALLOC_ZERO_P(mem_ctx, struct drsuapi_DsReplicaObjectIdentifier);
+        nc = talloc_zero(mem_ctx, struct drsuapi_DsReplicaObjectIdentifier);
         if (!nc) {
                 status = NT_STATUS_NO_MEMORY;
@@ -352 +372 @@
             !ctx->force_full_replication && utdv)
         {
-                cursors = TALLOC_ZERO_P(mem_ctx,
+                cursors = talloc_zero(mem_ctx,
                                          struct drsuapi_DsReplicaCursorCtrEx);
                 if (!cursors) {
@@ -443 +463 @@
 
         if (!ctx->single_object_replication) {
-                new_utdv = TALLOC_ZERO_P(mem_ctx, struct replUpToDateVectorBlob);
+                new_utdv = talloc_zero(mem_ctx, struct replUpToDateVectorBlob);
                 if (!new_utdv) {
                         status = NT_STATUS_NO_MEMORY;
@@ -653 +673 @@
                                                     &pnew_utdv);
                 if (!NT_STATUS_IS_OK(status)) {
-                        ctx->error_message = talloc_asprintf(ctx,
-                                "Failed to call DsGetNCCHanges: %s",
-                                nt_errstr(status));
+                        if (!ctx->error_message) {
+                                ctx->error_message = talloc_asprintf(ctx,
+                                        "Failed to call DsGetNCCHanges: %s",
+                                        nt_errstr(status));
+                        }
                         goto out;
                 }

vendor/current/source3/libnet/libnet_dssync_keytab.c

@@ -21 +21 @@
 #include "includes.h"
 #include "smb_krb5.h"
-#include "ads.h"
 #include "libnet/libnet_dssync.h"
 #include "libnet/libnet_keytab.h"
@@ -201 +200 @@
         }
 
-        pkb = TALLOC_ZERO_P(mem_ctx, struct package_PrimaryKerberosBlob);
+        pkb = talloc_zero(mem_ctx, struct package_PrimaryKerberosBlob);
         if (!pkb) {
                 status = NT_STATUS_NO_MEMORY;
@@ -277 +276 @@
                         uint32_t count;
                         num_spns = attr->value_ctr.num_values;
-                        spn = TALLOC_ARRAY(mem_ctx, char *, num_spns);
+                        spn = talloc_array(mem_ctx, char *, num_spns);
                         for (count = 0; count < num_spns; count++) {
                                 blob = attr->value_ctr.values[count].blob;
@@ -388 +387 @@
                                              mem_ctx);
                 if (entry) {
-                        name = (char *)TALLOC_MEMDUP(mem_ctx,
+                        name = (char *)talloc_memdup(mem_ctx,
                                                      entry->password.data,
                                                      entry->password.length);

vendor/current/source3/libnet/libnet_dssync_passdb.c

@@ -25 +25 @@
 #include "../librpc/gen_ndr/ndr_drsuapi.h"
 #include "util_tdb.h"
-#include "dbwrap.h"
+#include "dbwrap/dbwrap.h"
+#include "dbwrap/dbwrap_rbt.h"
 #include "../libds/common/flag_mapping.h"
 #include "passdb.h"
@@ -63 +64 @@
         NTSTATUS status;
         struct db_record *rec;
-
-        rec = db->fetch_locked(db, talloc_tos(), obj->key);
+        TDB_DATA value;
+
+        rec = dbwrap_fetch_locked(db, talloc_tos(), obj->key);
         if (rec == NULL) {
                 return NT_STATUS_NO_MEMORY;
         }
-        if (rec->value.dsize != 0) {
+
+        value = dbwrap_record_get_value(rec);
+        if (value.dsize != 0) {
                 abort();
         }
 
-        status = rec->store(rec, obj->data, TDB_INSERT);
+        status = dbwrap_record_store(rec, obj->data, TDB_INSERT);
         if (!NT_STATUS_IS_OK(status)) {
                 TALLOC_FREE(rec);
@@ -103 +107 @@
 {
         struct dssync_passdb_obj *obj;
-        int ret;
         TDB_DATA key;
         TDB_DATA data;
-
-        key = make_tdb_data((const uint8_t *)(void *)guid,
+        NTSTATUS status;
+
+        key = make_tdb_data((const uint8_t *)(const void *)guid,
                              sizeof(*guid));
 
-        ret = db->fetch(db, talloc_tos(), key, &data);
-        if (ret != 0) {
+        status = dbwrap_fetch(db, talloc_tos(), key, &data);
+        if (!NT_STATUS_IS_OK(status)) {
                 return NULL;
         }
@@ -160 +164 @@
         NTSTATUS status;
         struct db_record *rec;
-
-        rec = obj->members->fetch_locked(obj->members, talloc_tos(), mem->key);
+        TDB_DATA value;
+
+        rec = dbwrap_fetch_locked(obj->members, talloc_tos(), mem->key);
         if (rec == NULL) {
                 return NT_STATUS_NO_MEMORY;
         }
-        if (rec->value.dsize != 0) {
+
+        value = dbwrap_record_get_value(rec);
+        if (value.dsize != 0) {
                 abort();
         }
 
-        status = rec->store(rec, mem->data, TDB_INSERT);
+        status = dbwrap_record_store(rec, mem->data, TDB_INSERT);
         if (!NT_STATUS_IS_OK(status)) {
                 TALLOC_FREE(rec);
@@ -299 +306 @@
         bool is_member = false;
         const char *action;
+        TDB_DATA value;
 
         state->idx++;
@@ -304 +312 @@
         alias_sid = state->obj->cur->object.identifier->sid;
 
-        mem = dssync_parse_mem(rec->value);
+        value = dbwrap_record_get_value(rec);
+        mem = dssync_parse_mem(value);
         if (mem == NULL) {
                 return -1;
@@ -387 +396 @@
         struct dssync_passdb_traverse_amembers mstate;
         struct dssync_passdb_obj *obj;
-        int ret;
+        TDB_DATA value;
+        NTSTATUS status;
 
         state->idx++;
@@ -394 +404 @@
         }
 
-        obj = dssync_parse_obj(rec->value);
+        value = dbwrap_record_get_value(rec);
+        obj = dssync_parse_obj(value);
         if (obj == NULL) {
                 return -1;
@@ -403 +414 @@
         mstate.name = "members";
         mstate.obj = obj;
-        ret = obj->members->traverse_read(obj->members,
-                                          dssync_passdb_traverse_amembers,
-                                          &mstate);
-        if (ret < 0) {
+        status = dbwrap_traverse_read(obj->members,
+                                      dssync_passdb_traverse_amembers,
+                                      &mstate, NULL);
+        if (!NT_STATUS_IS_OK(status)) {
                 return -1;
         }
@@ -442 +453 @@
         struct samu *member = NULL;
         const char *member_dn = NULL;
-        GROUP_MAP map;
+        GROUP_MAP *map;
         struct group *grp;
         uint32_t rid;
         bool is_unix_member = false;
+        TDB_DATA value;
 
         state->idx++;
@@ -456 +468 @@
         }
 
-        mem = dssync_parse_mem(rec->value);
+        value = dbwrap_record_get_value(rec);
+
+        mem = dssync_parse_mem(value);
         if (mem == NULL) {
                 return -1;
@@ -495 +509 @@
         }
 
-        if (!get_domain_group_from_sid(group_sid, &map)) {
+        map = talloc_zero(NULL, GROUP_MAP);
+        if (!map) {
+                return -1;
+        }
+
+        if (!get_domain_group_from_sid(group_sid, map)) {
                 DEBUG(0, ("Could not find global group %s\n",
                           sid_string_dbg(&group_sid)));
                 //return NT_STATUS_NO_SUCH_GROUP;
+                TALLOC_FREE(map);
                 return -1;
         }
 
-        if (!(grp = getgrgid(map.gid))) {
-                DEBUG(0, ("Could not find unix group %lu\n", (unsigned long)map.gid));
+        if (!(grp = getgrgid(map->gid))) {
+                DEBUG(0, ("Could not find unix group %lu\n",
+                                                (unsigned long)map->gid));
                 //return NT_STATUS_NO_SUCH_GROUP;
+                TALLOC_FREE(map);
                 return -1;
         }
+
+        TALLOC_FREE(map);
 
         DEBUG(0,("Group members of %s: ", grp->gr_name));
@@ -563 +587 @@
         struct dssync_passdb_traverse_gmembers mstate;
         struct dssync_passdb_obj *obj;
-        int ret;
+        TDB_DATA value;
+        NTSTATUS status;
 
         state->idx++;
@@ -570 +595 @@
         }
 
-        obj = dssync_parse_obj(rec->value);
+        value = dbwrap_record_get_value(rec);
+
+        obj = dssync_parse_obj(value);
         if (obj == NULL) {
                 return -1;
@@ -579 +606 @@
         mstate.name = "members";
         mstate.obj = obj;
-        ret = obj->members->traverse_read(obj->members,
-                                          dssync_passdb_traverse_gmembers,
-                                          &mstate);
-        if (ret < 0) {
+        status = dbwrap_traverse_read(obj->members,
+                                      dssync_passdb_traverse_gmembers,
+                                      &mstate, NULL);
+        if (!NT_STATUS_IS_OK(status)) {
                 return -1;
         }
@@ -597 +624 @@
         struct dssync_passdb_traverse_aliases astate;
         struct dssync_passdb_traverse_groups gstate;
-        int ret;
+        NTSTATUS status;
 
         ZERO_STRUCT(astate);
         astate.ctx = ctx;
         astate.name = "aliases";
-        ret = pctx->aliases->traverse_read(pctx->aliases,
-                                           dssync_passdb_traverse_aliases,
-                                           &astate);
-        if (ret < 0) {
+        status = dbwrap_traverse_read(pctx->aliases,
+                                      dssync_passdb_traverse_aliases,
+                                      &astate, NULL);
+        if (!NT_STATUS_IS_OK(status)) {
                 return NT_STATUS_INTERNAL_ERROR;
         }
@@ -612 +639 @@
         gstate.ctx = ctx;
         gstate.name = "groups";
-        ret = pctx->groups->traverse_read(pctx->groups,
-                                          dssync_passdb_traverse_groups,
-                                          &gstate);
-        if (ret < 0) {
+        status = dbwrap_traverse_read(pctx->groups,
+                                      dssync_passdb_traverse_groups,
+                                      &gstate, NULL);
+        if (!NT_STATUS_IS_OK(status)) {
                 return NT_STATUS_INTERNAL_ERROR;
         }
@@ -644 +671 @@
         /* Create appropriate user */
         if (acct_flags & ACB_NORMAL) {
-                add_script = talloc_strdup(mem_ctx, lp_adduser_script());
+                add_script = lp_add_user_script(mem_ctx);
         } else if ( (acct_flags & ACB_WSTRUST) ||
                     (acct_flags & ACB_SVRTRUST) ||
                     (acct_flags & ACB_DOMTRUST) ) {
-                add_script = talloc_strdup(mem_ctx, lp_addmachine_script());
+                add_script = lp_add_machine_script(mem_ctx);
         } else {
                 DEBUG(1, ("Unknown user type: %s\n",
@@ -1093 +1120 @@
         const char *description;
         const char *userWorkstations;
-        const char *comment;
         DATA_BLOB userParameters;
         struct dom_sid objectSid;
@@ -1125 +1151 @@
         GET_STRING(description);
         GET_STRING(userWorkstations);
-        GET_STRING(comment);
         GET_BLOB(userParameters);
         GET_UINT32(primaryGroupID);
@@ -1332 +1357 @@
         fstring account;
         struct samu *sam_account=NULL;
-        GROUP_MAP map;
+        GROUP_MAP *map;
         struct group *grp;
         struct dom_sid user_sid;
@@ -1341 +1366 @@
 
         const char *sAMAccountName;
-        uint32_t sAMAccountType;
         uint32_t userAccountControl;
 
         user_sid = cur->object.identifier->sid;
         GET_STRING_EX(sAMAccountName, true);
-        GET_UINT32_EX(sAMAccountType, true);
         GET_UINT32_EX(userAccountControl, true);
 
@@ -1414 +1437 @@
         group_sid = *pdb_get_group_sid(sam_account);
 
-        if (!pdb_getgrsid(&map, group_sid)) {
+        map = talloc_zero(NULL, GROUP_MAP);
+        if (!map) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        if (!pdb_getgrsid(map, group_sid)) {
                 DEBUG(0, ("Primary group of %s has no mapping!\n",
                           pdb_get_username(sam_account)));
         } else {
-                if (map.gid != passwd->pw_gid) {
-                        if (!(grp = getgrgid(map.gid))) {
+                if (map->gid != passwd->pw_gid) {
+                        if (!(grp = getgrgid(map->gid))) {
                                 DEBUG(0, ("Could not find unix group %lu for user %s (group SID=%s)\n",
-                                          (unsigned long)map.gid, pdb_get_username(sam_account),
+                                          (unsigned long)map->gid, pdb_get_username(sam_account),
                                           sid_string_dbg(&group_sid)));
                         } else {
@@ -1429 +1457 @@
         }
 
+        TALLOC_FREE(map);
+
         if ( !passwd ) {
                 DEBUG(1, ("No unix user for this account (%s), cannot adjust mappings\n",
@@ -1447 +1477 @@
         struct drsuapi_DsReplicaObjectListItemEx *cur = obj->cur;
         NTSTATUS status;
-        fstring name;
-        fstring comment;
         struct group *grp = NULL;
         struct dom_sid group_sid;
@@ -1454 +1482 @@
         struct dom_sid *dom_sid = NULL;
         fstring sid_string;
-        GROUP_MAP map;
+        GROUP_MAP *map;
         bool insert = true;
 
         const char *sAMAccountName;
-        uint32_t sAMAccountType;
-        uint32_t groupType;
         const char *description;
         uint32_t i;
@@ -1467 +1493 @@
         group_sid = cur->object.identifier->sid;
         GET_STRING_EX(sAMAccountName, true);
-        GET_UINT32_EX(sAMAccountType, true);
-        GET_UINT32_EX(groupType, true);
         GET_STRING(description);
 
@@ -1480 +1504 @@
         }
 
-        fstrcpy(name, sAMAccountName);
-        fstrcpy(comment, description);
-
         dom_sid_split_rid(mem_ctx, &group_sid, &dom_sid, &rid);
+
+        map = talloc_zero(mem_ctx, GROUP_MAP);
+        if (map == NULL) {
+                status = NT_STATUS_NO_MEMORY;
+                goto done;
+        }
+
+        map->nt_name = talloc_strdup(map, sAMAccountName);
+        if (map->nt_name == NULL) {
+                status = NT_STATUS_NO_MEMORY;
+                goto done;
+        }
+
+        if (description) {
+                map->comment = talloc_strdup(map, description);
+        } else {
+                map->comment = talloc_strdup(map, "");
+        }
+        if (map->comment == NULL) {
+                status = NT_STATUS_NO_MEMORY;
+                goto done;
+        }
 
         sid_to_fstring(sid_string, &group_sid);
         DEBUG(0,("Creating alias[%s] - %s members[%u]\n",
-                  name, sid_string, num_members));
+                  map->nt_name, sid_string, num_members));
 
         status = dssync_insert_obj(pctx, pctx->aliases, obj);
         if (!NT_STATUS_IS_OK(status)) {
-                return status;
-        }
-
-        if (pdb_getgrsid(&map, group_sid)) {
-                if ( map.gid != -1 )
-                        grp = getgrgid(map.gid);
+                goto done;
+        }
+
+        if (pdb_getgrsid(map, group_sid)) {
+                if (map->gid != -1) {
+                        grp = getgrgid(map->gid);
+                }
                 insert = false;
         }
@@ -1504 +1548 @@
 
                 /* No group found from mapping, find it from its name. */
-                if ((grp = getgrnam(name)) == NULL) {
+                if ((grp = getgrnam(map->nt_name)) == NULL) {
 
                         /* No appropriate group found, create one */
 
-                        DEBUG(0,("Creating unix group: '%s'\n", name));
-
-                        if (smb_create_group(name, &gid) != 0)
-                                return NT_STATUS_ACCESS_DENIED;
-
-                        if ((grp = getgrgid(gid)) == NULL)
-                                return NT_STATUS_ACCESS_DENIED;
-                }
-        }
-
-        map.gid = grp->gr_gid;
-        map.sid = group_sid;
+                        DEBUG(0, ("Creating unix group: '%s'\n",
+                                                        map->nt_name));
+
+                        if (smb_create_group(map->nt_name, &gid) != 0) {
+                                status = NT_STATUS_ACCESS_DENIED;
+                                goto done;
+                        }
+
+                        if ((grp = getgrgid(gid)) == NULL) {
+                                status = NT_STATUS_ACCESS_DENIED;
+                                goto done;
+                        }
+                }
+        }
+
+        map->gid = grp->gr_gid;
+        map->sid = group_sid;
 
         if (dom_sid_equal(dom_sid, &global_sid_Builtin)) {
@@ -1527 +1576 @@
                  * map.sid_name_use = SID_NAME_WKN_GRP;
                  */
-                map.sid_name_use = SID_NAME_ALIAS;
+                map->sid_name_use = SID_NAME_ALIAS;
         } else {
-                map.sid_name_use = SID_NAME_ALIAS;
-        }
-
-        fstrcpy(map.nt_name, name);
-        if (description) {
-                fstrcpy(map.comment, comment);
+                map->sid_name_use = SID_NAME_ALIAS;
+        }
+
+        if (insert) {
+                pdb_add_group_mapping_entry(map);
         } else {
-                fstrcpy(map.comment, "");
-        }
-
-        if (insert)
-                pdb_add_group_mapping_entry(&map);
-        else
-                pdb_update_group_mapping_entry(&map);
+                pdb_update_group_mapping_entry(map);
+        }
 
         for (i=0; i < num_members; i++) {
@@ -1551 +1594 @@
                                            &members[i], &mem);
                 if (!NT_STATUS_IS_OK(status)) {
-                        return status;
-                }
-        }
-
-        return NT_STATUS_OK;
+                        goto done;
+                }
+        }
+
+        status = NT_STATUS_OK;
+
+done:
+        TALLOC_FREE(map);
+        return status;
 }
 
@@ -1567 +1614 @@
         struct drsuapi_DsReplicaObjectListItemEx *cur = obj->cur;
         NTSTATUS status;
-        fstring name;
-        fstring comment;
         struct group *grp = NULL;
         struct dom_sid group_sid;
         fstring sid_string;
-        GROUP_MAP map;
+        GROUP_MAP *map;
         bool insert = true;
 
         const char *sAMAccountName;
-        uint32_t sAMAccountType;
-        uint32_t groupType;
         const char *description;
         uint32_t i;
@@ -1585 +1628 @@
         group_sid = cur->object.identifier->sid;
         GET_STRING_EX(sAMAccountName, true);
-        GET_UINT32_EX(sAMAccountType, true);
-        GET_UINT32_EX(groupType, true);
         GET_STRING(description);
 
@@ -1598 +1639 @@
         }
 
-        fstrcpy(name, sAMAccountName);
-        fstrcpy(comment, description);
+        map = talloc_zero(NULL, GROUP_MAP);
+        if (!map) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        map->nt_name = talloc_strdup(map, sAMAccountName);
+        if (!map->nt_name) {
+                status = NT_STATUS_NO_MEMORY;
+                goto done;
+        }
+        if (description) {
+                map->comment = talloc_strdup(map, description);
+        } else {
+                map->comment = talloc_strdup(map, "");
+        }
+        if (!map->comment) {
+                status = NT_STATUS_NO_MEMORY;
+                goto done;
+        }
 
         sid_to_fstring(sid_string, &group_sid);
         DEBUG(0,("Creating group[%s] - %s members [%u]\n",
-                  name, sid_string, num_members));
+                  map->nt_name, sid_string, num_members));
 
         status = dssync_insert_obj(pctx, pctx->groups, obj);
         if (!NT_STATUS_IS_OK(status)) {
-                return status;
-        }
-
-        if (pdb_getgrsid(&map, group_sid)) {
-                if ( map.gid != -1 )
-                        grp = getgrgid(map.gid);
+                goto done;
+        }
+
+        if (pdb_getgrsid(map, group_sid)) {
+                if (map->gid != -1) {
+                        grp = getgrgid(map->gid);
+                }
                 insert = false;
         }
@@ -1620 +1679 @@
 
                 /* No group found from mapping, find it from its name. */
-                if ((grp = getgrnam(name)) == NULL) {
+                if ((grp = getgrnam(map->nt_name)) == NULL) {
 
                         /* No appropriate group found, create one */
 
-                        DEBUG(0,("Creating unix group: '%s'\n", name));
-
-                        if (smb_create_group(name, &gid) != 0)
-                                return NT_STATUS_ACCESS_DENIED;
-
-                        if ((grp = getgrnam(name)) == NULL)
-                                return NT_STATUS_ACCESS_DENIED;
-                }
-        }
-
-        map.gid = grp->gr_gid;
-        map.sid = group_sid;
-        map.sid_name_use = SID_NAME_DOM_GRP;
-        fstrcpy(map.nt_name, name);
-        if (description) {
-                fstrcpy(map.comment, comment);
+                        DEBUG(0, ("Creating unix group: '%s'\n",
+                                                        map->nt_name));
+
+                        if (smb_create_group(map->nt_name, &gid) != 0) {
+                                status = NT_STATUS_ACCESS_DENIED;
+                                goto done;
+                        }
+
+                        if ((grp = getgrnam(map->nt_name)) == NULL) {
+                                status = NT_STATUS_ACCESS_DENIED;
+                                goto done;
+                        }
+                }
+        }
+
+        map->gid = grp->gr_gid;
+        map->sid = group_sid;
+        map->sid_name_use = SID_NAME_DOM_GRP;
+
+        if (insert) {
+                pdb_add_group_mapping_entry(map);
         } else {
-                fstrcpy(map.comment, "");
-        }
-
-        if (insert)
-                pdb_add_group_mapping_entry(&map);
-        else
-                pdb_update_group_mapping_entry(&map);
+                pdb_update_group_mapping_entry(map);
+        }
 
         for (i=0; i < num_members; i++) {
@@ -1656 +1715 @@
                                            &members[i], &mem);
                 if (!NT_STATUS_IS_OK(status)) {
-                        return status;
-                }
-        }
-
-        return NT_STATUS_OK;
+                        goto done;
+                }
+        }
+
+        status = NT_STATUS_OK;
+
+done:
+        TALLOC_FREE(map);
+        return status;
 }
 
@@ -1707 +1770 @@
 
         char *name = NULL;
-        uint32_t uacc = 0;
         uint32_t sam_type = 0;
 
@@ -1734 +1796 @@
                         case DRSUAPI_ATTID_sAMAccountType:
                                 sam_type = IVAL(blob->data, 0);
-                                break;
-                        case DRSUAPI_ATTID_userAccountControl:
-                                uacc = IVAL(blob->data, 0);
                                 break;
                         default:

vendor/current/source3/libnet/libnet_join.c

@@ -39 +39 @@
 #include "passdb.h"
 #include "libsmb/libsmb.h"
+#include "../libcli/smb/smbXcli_base.h"
+#include "lib/param/loadparm.h"
+#include "libcli/auth/netlogon_creds_cli.h"
+#include "auth/credentials/credentials.h"
+#include "krb5_env.h"
 
 /****************************************************************
@@ -115 +120 @@
                                      const char *user_name,
                                      const char *password,
+                                     const char *ccname,
                                      ADS_STRUCT **ads)
 {
@@ -135 +141 @@
                         SAFE_FREE(my_ads->auth.realm);
                         my_ads->auth.realm = smb_xstrdup(cp);
-                        strupper_m(my_ads->auth.realm);
+                        if (!strupper_m(my_ads->auth.realm)) {
+                                ads_destroy(&my_ads);
+                                return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
+                        }
                 }
         }
@@ -144 +153 @@
         }
 
+        if (ccname != NULL) {
+                SAFE_FREE(my_ads->auth.ccache_name);
+                my_ads->auth.ccache_name = SMB_STRDUP(ccname);
+                setenv(KRB5_ENV_CCNAME, my_ads->auth.ccache_name, 1);
+        }
+
         status = ads_connect_user_creds(my_ads);
         if (!ADS_ERR_OK(status)) {
@@ -158 +173 @@
 
 static ADS_STATUS libnet_join_connect_ads(TALLOC_CTX *mem_ctx,
-                                          struct libnet_JoinCtx *r)
+                                          struct libnet_JoinCtx *r,
+                                          bool use_machine_creds)
 {
         ADS_STATUS status;
+        const char *username;
+        const char *password;
+        const char *ccname = NULL;
+
+        if (use_machine_creds) {
+                if (r->in.machine_name == NULL ||
+                    r->in.machine_password == NULL) {
+                        return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+                }
+                username = talloc_strdup(mem_ctx, r->in.machine_name);
+                if (username == NULL) {
+                        return ADS_ERROR(LDAP_NO_MEMORY);
+                }
+                if (username[strlen(username)] != '$') {
+                        username = talloc_asprintf(username, "%s$", username);
+                        if (username == NULL) {
+                                return ADS_ERROR(LDAP_NO_MEMORY);
+                        }
+                }
+                password = r->in.machine_password;
+                ccname = "MEMORY:libnet_join_machine_creds";
+        } else {
+                username = r->in.admin_account;
+                password = r->in.admin_password;
+
+                /*
+                 * when r->in.use_kerberos is set to allow "net ads join -k" we
+                 * may not override the provided credential cache - gd
+                 */
+
+                if (!r->in.use_kerberos) {
+                        ccname = "MEMORY:libnet_join_user_creds";
+                }
+        }
 
         status = libnet_connect_ads(r->out.dns_domain_name,
                                     r->out.netbios_domain_name,
                                     r->in.dc_name,
-                                    r->in.admin_account,
-                                    r->in.admin_password,
+                                    username,
+                                    password,
+                                    ccname,
                                     &r->in.ads);
         if (!ADS_ERR_OK(status)) {
@@ -195 +246 @@
 ****************************************************************/
 
+static ADS_STATUS libnet_join_connect_ads_user(TALLOC_CTX *mem_ctx,
+                                               struct libnet_JoinCtx *r)
+{
+        return libnet_join_connect_ads(mem_ctx, r, false);
+}
+
+/****************************************************************
+****************************************************************/
+
+static ADS_STATUS libnet_join_connect_ads_machine(TALLOC_CTX *mem_ctx,
+                                                  struct libnet_JoinCtx *r)
+{
+        return libnet_join_connect_ads(mem_ctx, r, true);
+}
+
+/****************************************************************
+****************************************************************/
+
 static ADS_STATUS libnet_unjoin_connect_ads(TALLOC_CTX *mem_ctx,
                                             struct libnet_UnjoinCtx *r)
@@ -205 +274 @@
                                     r->in.admin_account,
                                     r->in.admin_password,
+                                    NULL,
                                     &r->in.ads);
         if (!ADS_ERR_OK(status)) {
@@ -249 +319 @@
         status = ads_create_machine_acct(r->in.ads,
                                          r->in.machine_name,
-                                         r->in.account_ou);
+                                         r->in.account_ou,
+                                         r->in.desired_encryption_types);
 
         if (ADS_ERR_OK(status)) {
@@ -347 +418 @@
         }
 
+        if (!ads_pull_uint32(r->in.ads, res, "msDS-SupportedEncryptionTypes",
+                             &r->out.set_encryption_types)) {
+                r->out.set_encryption_types = 0;
+        }
+
  done:
         ads_msgfree(r->in.ads, res);
@@ -354 +430 @@
 }
 
+static ADS_STATUS libnet_join_get_machine_spns(TALLOC_CTX *mem_ctx,
+                                               struct libnet_JoinCtx *r,
+                                               char ***spn_array,
+                                               size_t *num_spns)
+{
+        ADS_STATUS status;
+
+        if (r->in.machine_name == NULL) {
+                return ADS_ERROR_SYSTEM(EINVAL);
+        }
+
+        status = ads_get_service_principal_names(mem_ctx,
+                                                 r->in.ads,
+                                                 r->in.machine_name,
+                                                 spn_array,
+                                                 num_spns);
+
+        return status;
+}
+
 /****************************************************************
  Set a machines dNSHostName and servicePrincipalName attributes
@@ -364 +460 @@
         ADS_MODLIST mods;
         fstring my_fqdn;
-        const char *spn_array[3] = {NULL, NULL, NULL};
+        const char **spn_array = NULL;
+        size_t num_spns = 0;
         char *spn = NULL;
+        bool ok;
 
         /* Find our DN */
@@ -372 +470 @@
         if (!ADS_ERR_OK(status)) {
                 return status;
+        }
+
+        status = libnet_join_get_machine_spns(mem_ctx,
+                                              r,
+                                              discard_const_p(char **, &spn_array),
+                                              &num_spns);
+        if (!ADS_ERR_OK(status)) {
+                DEBUG(5, ("Retrieving the servicePrincipalNames failed.\n"));
         }
 
@@ -380 +486 @@
                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
         }
-        strupper_m(spn);
-        spn_array[0] = spn;
+        if (!strupper_m(spn)) {
+                return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
+        }
+
+        ok = ads_element_in_array(spn_array, num_spns, spn);
+        if (!ok) {
+                ok = add_string_to_array(spn_array, spn,
+                                         &spn_array, &num_spns);
+                if (!ok) {
+                        return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
+                }
+        }
 
         if (!name_to_fqdn(my_fqdn, r->in.machine_name)
@@ -389 +505 @@
         }
 
-        strlower_m(my_fqdn);
+        if (!strlower_m(my_fqdn)) {
+                return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
+        }
 
         if (!strequal(my_fqdn, r->in.machine_name)) {
@@ -396 +514 @@
                         return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
                 }
-                spn_array[1] = spn;
-        }
+
+                ok = ads_element_in_array(spn_array, num_spns, spn);
+                if (!ok) {
+                        ok = add_string_to_array(spn_array, spn,
+                                                 &spn_array, &num_spns);
+                        if (!ok) {
+                                return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
+                        }
+                }
+        }
+
+        /* make sure to NULL terminate the array */
+        spn_array = talloc_realloc(mem_ctx, spn_array, const char *, num_spns + 1);
+        if (spn_array == NULL) {
+                return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
+        }
+        spn_array[num_spns] = NULL;
 
         mods = ads_init_mods(mem_ctx);
@@ -441 +574 @@
 
         if (!r->in.upn) {
+                const char *realm = r->out.dns_domain_name;
+
+                /* in case we are about to generate a keytab during the join
+                 * make sure the default upn we create is usable with kinit -k.
+                 * gd */
+
+                if (USE_KERBEROS_KEYTAB) {
+                        realm = talloc_strdup_upper(mem_ctx,
+                                                    r->out.dns_domain_name);
+                }
+
+                if (!realm) {
+                        return ADS_ERROR(LDAP_NO_MEMORY);
+                }
+
                 r->in.upn = talloc_asprintf(mem_ctx,
                                             "host/%s@%s",
                                             r->in.machine_name,
-                                            r->out.dns_domain_name);
+                                            realm);
                 if (!r->in.upn) {
                         return ADS_ERROR(LDAP_NO_MEMORY);
@@ -496 +644 @@
         }
 
-        os_sp = talloc_asprintf(mem_ctx, "Samba %s", samba_version_string());
-        if (!os_sp) {
+        if (r->in.os_servicepack) {
+                /*
+                 * if blank string then leave os_sp equal to NULL to force
+                 * attribute delete (LDAP_MOD_DELETE)
+                 */
+                if (!strequal(r->in.os_servicepack,"")) {
+                        os_sp = talloc_strdup(mem_ctx, r->in.os_servicepack);
+                }
+        } else {
+                os_sp = talloc_asprintf(mem_ctx, "Samba %s",
+                                        samba_version_string());
+        }
+        if (!os_sp && !strequal(r->in.os_servicepack,"")) {
                 return ADS_ERROR(LDAP_NO_MEMORY);
         }
@@ -522 +681 @@
 
         return ads_gen_mod(r->in.ads, r->out.dn, mods);
+}
+
+/****************************************************************
+****************************************************************/
+
+static ADS_STATUS libnet_join_set_etypes(TALLOC_CTX *mem_ctx,
+                                         struct libnet_JoinCtx *r)
+{
+        ADS_STATUS status;
+        ADS_MODLIST mods;
+        const char *etype_list_str;
+
+        etype_list_str = talloc_asprintf(mem_ctx, "%d",
+                                         r->in.desired_encryption_types);
+        if (!etype_list_str) {
+                return ADS_ERROR(LDAP_NO_MEMORY);
+        }
+
+        /* Find our DN */
+
+        status = libnet_join_find_machine_acct(mem_ctx, r);
+        if (!ADS_ERR_OK(status)) {
+                return status;
+        }
+
+        if (r->in.desired_encryption_types == r->out.set_encryption_types) {
+                return ADS_SUCCESS;
+        }
+
+        /* now do the mods */
+
+        mods = ads_init_mods(mem_ctx);
+        if (!mods) {
+                return ADS_ERROR(LDAP_NO_MEMORY);
+        }
+
+        status = ads_mod_str(mem_ctx, &mods, "msDS-SupportedEncryptionTypes",
+                             etype_list_str);
+        if (!ADS_ERR_OK(status)) {
+                return status;
+        }
+
+        status = ads_gen_mod(r->in.ads, r->out.dn, mods);
+        if (!ADS_ERR_OK(status)) {
+                return status;
+        }
+
+        r->out.set_encryption_types = r->in.desired_encryption_types;
+
+        return ADS_SUCCESS;
 }
 
@@ -601 +810 @@
 {
         ADS_STATUS status;
+        bool need_etype_update = false;
 
         if (!r->in.ads) {
-                status = libnet_join_connect_ads(mem_ctx, r);
+                status = libnet_join_connect_ads_user(mem_ctx, r);
                 if (!ADS_ERR_OK(status)) {
                         return status;
@@ -612 +822 @@
         if (!ADS_ERR_OK(status)) {
                 libnet_join_set_error_string(mem_ctx, r,
-                        "failed to set machine spn: %s",
+                        "Failed to set machine spn: %s\n"
+                        "Do you have sufficient permissions to create machine "
+                        "accounts?",
                         ads_errstr(status));
                 return status;
@@ -631 +843 @@
                         ads_errstr(status));
                 return status;
+        }
+
+        status = libnet_join_find_machine_acct(mem_ctx, r);
+        if (!ADS_ERR_OK(status)) {
+                return status;
+        }
+
+        if (r->in.desired_encryption_types != r->out.set_encryption_types) {
+                uint32_t func_level = 0;
+
+                status = ads_domain_func_level(r->in.ads, &func_level);
+                if (!ADS_ERR_OK(status)) {
+                        libnet_join_set_error_string(mem_ctx, r,
+                                "failed to query domain controller functional level: %s",
+                                ads_errstr(status));
+                        return status;
+                }
+
+                if (func_level >= DS_DOMAIN_FUNCTION_2008) {
+                        need_etype_update = true;
+                }
+        }
+
+        if (need_etype_update) {
+                /*
+                 * We need to reconnect as machine account in order
+                 * to update msDS-SupportedEncryptionTypes reliable
+                 */
+
+                if (r->in.ads->auth.ccache_name != NULL) {
+                        ads_kdestroy(r->in.ads->auth.ccache_name);
+                }
+
+                ads_destroy(&r->in.ads);
+
+                status = libnet_join_connect_ads_machine(mem_ctx, r);
+                if (!ADS_ERR_OK(status)) {
+                        libnet_join_set_error_string(mem_ctx, r,
+                                "Failed to connect as machine account: %s",
+                                ads_errstr(status));
+                        return status;
+                }
+
+                status = libnet_join_set_etypes(mem_ctx, r);
+                if (!ADS_ERR_OK(status)) {
+                        libnet_join_set_error_string(mem_ctx, r,
+                                "failed to set machine kerberos encryption types: %s",
+                                ads_errstr(status));
+                        return status;
+                }
         }
 
@@ -678 +940 @@
 static NTSTATUS libnet_join_connect_dc_ipc(const char *dc,
                                            const char *user,
+                                           const char *domain,
                                            const char *pass,
                                            bool use_kerberos,
@@ -697 +960 @@
                                    "IPC$", "IPC",
                                    user,
-                                   NULL,
+                                   domain,
                                    pass,
                                    flags,
-                                   Undefined);
+                                   SMB_SIGNING_IPC_DEFAULT);
 }
 
@@ -719 +982 @@
         status = libnet_join_connect_dc_ipc(r->in.dc_name,
                                             r->in.admin_account,
+                                            r->in.admin_domain,
                                             r->in.admin_password,
                                             r->in.use_kerberos,
@@ -726 +990 @@
         }
 
-        status = cli_rpc_pipe_open_noauth(*cli, &ndr_table_lsarpc.syntax_id,
+        status = cli_rpc_pipe_open_noauth(*cli, &ndr_table_lsarpc,
                                           &pipe_hnd);
         if (!NT_STATUS_IS_OK(status)) {
@@ -790 +1054 @@
                                                     struct cli_state *cli)
 {
-        struct rpc_pipe_client *pipe_hnd = NULL;
-        unsigned char orig_trust_passwd_hash[16];
-        unsigned char new_trust_passwd_hash[16];
-        fstring trust_passwd;
+        TALLOC_CTX *frame = talloc_stackframe();
+        struct rpc_pipe_client *netlogon_pipe = NULL;
+        struct netlogon_creds_cli_context *netlogon_creds = NULL;
+        struct samr_Password current_nt_hash;
+        const char *account_name = NULL;
         NTSTATUS status;
 
-        status = cli_rpc_pipe_open_noauth(cli, &ndr_table_netlogon.syntax_id,
-                                          &pipe_hnd);
-        if (!NT_STATUS_IS_OK(status)) {
+        status = cli_rpc_pipe_open_noauth(cli, &ndr_table_netlogon,
+                                          &netlogon_pipe);
+        if (!NT_STATUS_IS_OK(status)) {
+                TALLOC_FREE(frame);
                 return status;
         }
 
         if (!r->in.machine_password) {
-                r->in.machine_password = generate_random_str(mem_ctx, DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH);
-                NT_STATUS_HAVE_NO_MEMORY(r->in.machine_password);
-        }
-
-        E_md4hash(r->in.machine_password, new_trust_passwd_hash);
+                r->in.machine_password = generate_random_password(mem_ctx,
+                                DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH,
+                                DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH);
+                if (r->in.machine_password == NULL) {
+                        TALLOC_FREE(frame);
+                        return NT_STATUS_NO_MEMORY;
+                }
+        }
 
         /* according to WKSSVC_JOIN_FLAGS_MACHINE_PWD_PASSED */
-        fstrcpy(trust_passwd, r->in.admin_password);
-        strlower_m(trust_passwd);
-
-        /*
-         * Machine names can be 15 characters, but the max length on
-         * a password is 14.  --jerry
-         */
-
-        trust_passwd[14] = '\0';
-
-        E_md4hash(trust_passwd, orig_trust_passwd_hash);
-
-        status = rpccli_netlogon_set_trust_password(pipe_hnd, mem_ctx,
-                                                    r->in.machine_name,
-                                                    orig_trust_passwd_hash,
-                                                    r->in.machine_password,
-                                                    new_trust_passwd_hash,
-                                                    r->in.secure_channel_type);
-
-        return status;
+        E_md4hash(r->in.admin_password, current_nt_hash.hash);
+
+        account_name = talloc_asprintf(frame, "%s$",
+                                       r->in.machine_name);
+        if (account_name == NULL) {
+                TALLOC_FREE(frame);
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        status = rpccli_create_netlogon_creds(netlogon_pipe->desthost,
+                                              r->in.domain_name,
+                                              account_name,
+                                              r->in.secure_channel_type,
+                                              r->in.msg_ctx,
+                                              frame,
+                                              &netlogon_creds);
+        if (!NT_STATUS_IS_OK(status)) {
+                TALLOC_FREE(frame);
+                return status;
+        }
+
+        status = rpccli_setup_netlogon_creds(cli, NCACN_NP,
+                                             netlogon_creds,
+                                             true, /* force_reauth */
+                                             current_nt_hash,
+                                             NULL); /* previous_nt_hash */
+        if (!NT_STATUS_IS_OK(status)) {
+                TALLOC_FREE(frame);
+                return status;
+        }
+
+        status = netlogon_creds_cli_ServerPasswordSet(netlogon_creds,
+                                                      netlogon_pipe->binding_handle,
+                                                      r->in.machine_password,
+                                                      NULL); /* new_version */
+        if (!NT_STATUS_IS_OK(status)) {
+                TALLOC_FREE(frame);
+                return status;
+        }
+
+        TALLOC_FREE(frame);
+        return NT_STATUS_OK;
 }
 
@@ -853 +1144 @@
         unsigned int old_timeout = 0;
 
+        DATA_BLOB session_key = data_blob_null;
         struct samr_CryptPassword crypt_pwd;
         struct samr_CryptPasswordEx crypt_pwd_ex;
@@ -872 +1164 @@
 
         if (!r->in.machine_password) {
-                r->in.machine_password = generate_random_str(mem_ctx, DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH);
+                r->in.machine_password = generate_random_password(mem_ctx,
+                                DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH,
+                                DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH);
                 NT_STATUS_HAVE_NO_MEMORY(r->in.machine_password);
         }
@@ -878 +1172 @@
         /* Open the domain */
 
-        status = cli_rpc_pipe_open_noauth(cli, &ndr_table_samr.syntax_id,
+        status = cli_rpc_pipe_open_noauth(cli, &ndr_table_samr,
                                           &pipe_hnd);
         if (!NT_STATUS_IS_OK(status)) {
@@ -887 +1181 @@
 
         b = pipe_hnd->binding_handle;
+
+        status = cli_get_session_key(mem_ctx, pipe_hnd, &session_key);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0,("Error getting session_key of SAM pipe. Error was %s\n",
+                        nt_errstr(status)));
+                goto done;
+        }
 
         status = dcerpc_samr_Connect2(b, mem_ctx,
@@ -921 +1222 @@
 
         acct_name = talloc_asprintf(mem_ctx, "%s$", r->in.machine_name);
-        strlower_m(acct_name);
+        if (!strlower_m(acct_name)) {
+                status = NT_STATUS_INVALID_PARAMETER;
+                goto done;
+        }
 
         init_lsa_String(&lsa_acct_name, acct_name);
@@ -1078 +1382 @@
 
         init_samr_CryptPasswordEx(r->in.machine_password,
-                                  &cli->user_session_key,
+                                  &session_key,
                                   &crypt_pwd_ex);
 
@@ -1095 +1399 @@
 
                 init_samr_CryptPassword(r->in.machine_password,
-                                        &cli->user_session_key,
+                                        &session_key,
                                         &crypt_pwd);
 
@@ -1141 +1445 @@
         }
 
+        data_blob_clear_free(&session_key);
+
         if (is_valid_policy_hnd(&sam_pol)) {
                 dcerpc_samr_Close(b, mem_ctx, &sam_pol, &result);
@@ -1158 +1464 @@
 ****************************************************************/
 
-NTSTATUS libnet_join_ok(const char *netbios_domain_name,
-                        const char *machine_name,
-                        const char *dc_name)
-{
-        uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
+NTSTATUS libnet_join_ok(struct messaging_context *msg_ctx,
+                        const char *netbios_domain_name,
+                        const char *dc_name,
+                        const bool use_kerberos)
+{
+        TALLOC_CTX *frame = talloc_stackframe();
         struct cli_state *cli = NULL;
-        struct rpc_pipe_client *pipe_hnd = NULL;
         struct rpc_pipe_client *netlogon_pipe = NULL;
+        struct cli_credentials *cli_creds = NULL;
+        struct netlogon_creds_cli_context *netlogon_creds = NULL;
+        struct netlogon_creds_CredentialState *creds = NULL;
+        uint32_t netlogon_flags = 0;
         NTSTATUS status;
-        char *machine_password = NULL;
-        char *machine_account = NULL;
+        const char *machine_account = NULL;
+        const char *machine_domain = NULL;
+        const char *machine_password = NULL;
+        int flags = 0;
 
         if (!dc_name) {
+                TALLOC_FREE(frame);
                 return NT_STATUS_INVALID_PARAMETER;
         }
 
         if (!secrets_init()) {
+                TALLOC_FREE(frame);
                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
         }
 
-        machine_password = secrets_fetch_machine_password(netbios_domain_name,
-                                                          NULL, NULL);
-        if (!machine_password) {
-                return NT_STATUS_NO_TRUST_LSA_SECRET;
-        }
-
-        if (asprintf(&machine_account, "%s$", machine_name) == -1) {
-                SAFE_FREE(machine_password);
-                return NT_STATUS_NO_MEMORY;
-        }
+        status = pdb_get_trust_credentials(netbios_domain_name, NULL,
+                                           frame, &cli_creds);
+        if (!NT_STATUS_IS_OK(status)) {
+                TALLOC_FREE(frame);
+                return status;
+        }
+
+        /* we don't want any old password */
+        cli_credentials_set_old_password(cli_creds, NULL, CRED_SPECIFIED);
+
+        if (use_kerberos) {
+                flags |= CLI_FULL_CONNECTION_USE_KERBEROS;
+        }
+
+        machine_account = cli_credentials_get_username(cli_creds);
+        machine_domain = cli_credentials_get_domain(cli_creds);
+        machine_password = cli_credentials_get_password(cli_creds);
 
         status = cli_full_connection(&cli, NULL,
@@ -1194 +1515 @@
                                      "IPC$", "IPC",
                                      machine_account,
-                                     NULL,
+                                     machine_domain,
                                      machine_password,
-                                     0,
-                                     Undefined);
-        free(machine_account);
-        free(machine_password);
+                                     flags,
+                                     SMB_SIGNING_IPC_DEFAULT);
 
         if (!NT_STATUS_IS_OK(status)) {
@@ -1210 +1529 @@
                                              "",
                                              0,
-                                             Undefined);
-        }
-
-        if (!NT_STATUS_IS_OK(status)) {
-                return status;
-        }
-
-        status = get_schannel_session_key(cli, netbios_domain_name,
-                                          &neg_flags, &netlogon_pipe);
-        if (!NT_STATUS_IS_OK(status)) {
-                if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_NETWORK_RESPONSE)) {
-                        cli_shutdown(cli);
-                        return NT_STATUS_OK;
-                }
-
-                DEBUG(0,("libnet_join_ok: failed to get schannel session "
-                        "key from server %s for domain %s. Error was %s\n",
-                cli->desthost, netbios_domain_name, nt_errstr(status)));
+                                             SMB_SIGNING_IPC_DEFAULT);
+        }
+
+        if (!NT_STATUS_IS_OK(status)) {
+                TALLOC_FREE(frame);
+                return status;
+        }
+
+        status = rpccli_create_netlogon_creds_with_creds(cli_creds,
+                                                         dc_name,
+                                                         msg_ctx,
+                                                         frame,
+                                                         &netlogon_creds);
+        if (!NT_STATUS_IS_OK(status)) {
                 cli_shutdown(cli);
-                return status;
-        }
-
-        if (!lp_client_schannel()) {
+                TALLOC_FREE(frame);
+                return status;
+        }
+
+        status = rpccli_setup_netlogon_creds_with_creds(cli, NCACN_NP,
+                                                        netlogon_creds,
+                                                        true, /* force_reauth */
+                                                        cli_creds);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0,("connect_to_domain_password_server: "
+                         "unable to open the domain client session to "
+                         "machine %s. Flags[0x%08X] Error was : %s.\n",
+                         dc_name, (unsigned)netlogon_flags,
+                         nt_errstr(status)));
                 cli_shutdown(cli);
+                TALLOC_FREE(frame);
+                return status;
+        }
+
+        status = netlogon_creds_cli_get(netlogon_creds,
+                                        talloc_tos(),
+                                        &creds);
+        if (!NT_STATUS_IS_OK(status)) {
+                cli_shutdown(cli);
+                TALLOC_FREE(frame);
+                return status;
+        }
+        netlogon_flags = creds->negotiate_flags;
+        TALLOC_FREE(creds);
+
+        if (!(netlogon_flags & NETLOGON_NEG_AUTHENTICATED_RPC)) {
+                cli_shutdown(cli);
+                TALLOC_FREE(frame);
                 return NT_STATUS_OK;
         }
 
-        status = cli_rpc_pipe_open_schannel_with_key(
-                cli, &ndr_table_netlogon.syntax_id, NCACN_NP,
-                DCERPC_AUTH_LEVEL_PRIVACY,
-                netbios_domain_name, &netlogon_pipe->dc, &pipe_hnd);
-
-        cli_shutdown(cli);
+        status = cli_rpc_pipe_open_schannel_with_creds(
+                cli, &ndr_table_netlogon, NCACN_NP,
+                cli_creds,
+                netlogon_creds, &netlogon_pipe);
+
+        TALLOC_FREE(netlogon_pipe);
 
         if (!NT_STATUS_IS_OK(status)) {
@@ -1248 +1591 @@
                         "on netlogon pipe to server %s for domain %s. "
                         "Error was %s\n",
-                        cli->desthost, netbios_domain_name, nt_errstr(status)));
-                return status;
-        }
-
+                        smbXcli_conn_remote_name(cli->conn),
+                        netbios_domain_name, nt_errstr(status)));
+                cli_shutdown(cli);
+                TALLOC_FREE(frame);
+                return status;
+        }
+
+        cli_shutdown(cli);
+        TALLOC_FREE(frame);
         return NT_STATUS_OK;
 }
@@ -1263 +1611 @@
         NTSTATUS status;
 
-        status = libnet_join_ok(r->out.netbios_domain_name,
-                                r->in.machine_name,
-                                r->in.dc_name);
+        status = libnet_join_ok(r->in.msg_ctx,
+                                r->out.netbios_domain_name,
+                                r->in.dc_name,
+                                r->in.use_kerberos);
         if (!NT_STATUS_IS_OK(status)) {
                 libnet_join_set_error_string(mem_ctx, r,
@@ -1317 +1666 @@
         status = libnet_join_connect_dc_ipc(r->in.dc_name,
                                             r->in.admin_account,
+                                            r->in.admin_domain,
                                             r->in.admin_password,
                                             r->in.use_kerberos,
@@ -1326 +1676 @@
         /* Open the domain */
 
-        status = cli_rpc_pipe_open_noauth(cli, &ndr_table_samr.syntax_id,
+        status = cli_rpc_pipe_open_noauth(cli, &ndr_table_samr,
                                           &pipe_hnd);
         if (!NT_STATUS_IS_OK(status)) {
@@ -1366 +1716 @@
 
         acct_name = talloc_asprintf(mem_ctx, "%s$", r->in.machine_name);
-        strlower_m(acct_name);
+        if (!strlower_m(acct_name)) {
+                status = NT_STATUS_INVALID_PARAMETER;
+                goto done;
+        }
 
         init_lsa_String(&lsa_acct_name, acct_name);
@@ -1599 +1952 @@
         }
 
-        lp_load(get_dyn_CONFIGFILE(),true,false,false,true);
+        lp_load_global(get_dyn_CONFIGFILE());
 
         r->out.modified_config = true;
@@ -1627 +1980 @@
         }
 
-        lp_load(get_dyn_CONFIGFILE(),true,false,false,true);
+        lp_load_global(get_dyn_CONFIGFILE());
 
         r->out.modified_config = true;
@@ -1689 +2042 @@
         }
 
+        if (strlen(r->in.machine_name) > 15) {
+                libnet_join_set_error_string(mem_ctx, r,
+                        "Our netbios name can be at most 15 chars long, "
+                         "\"%s\" is %u chars long\n",
+                         r->in.machine_name,
+                         (unsigned int)strlen(r->in.machine_name));
+                return WERR_INVALID_PARAM;
+        }
+
         if (!libnet_parse_domain_dc(mem_ctx, r->in.domain_name,
                                     &r->in.domain_name,
@@ -1697 +2059 @@
         }
 
-        if (IS_DC) {
-                return WERR_SETUP_DOMAIN_CONTROLLER;
+        if (!r->in.admin_domain) {
+                char *admin_domain = NULL;
+                char *admin_account = NULL;
+                split_domain_user(mem_ctx,
+                                  r->in.admin_account,
+                                  &admin_domain,
+                                  &admin_account);
+                r->in.admin_domain = admin_domain;
+                r->in.admin_account = admin_account;
         }
 
@@ -1722 +2091 @@
                 DEBUG(10,("Unable to auto-add domain administrators to "
                           "BUILTIN\\Administrators during join because "
-                          "winbindd must be running."));
+                          "winbindd must be running.\n"));
         } else if (!NT_STATUS_IS_OK(status)) {
                 DEBUG(5, ("Failed to auto-add domain administrators to "
@@ -1733 +2102 @@
         if (NT_STATUS_EQUAL(status, NT_STATUS_PROTOCOL_UNREACHABLE)) {
                 DEBUG(10,("Unable to auto-add domain users to BUILTIN\\users "
-                          "during join because winbindd must be running."));
+                          "during join because winbindd must be running.\n"));
         } else if (!NT_STATUS_IS_OK(status)) {
                 DEBUG(5, ("Failed to auto-add domain administrators to "
@@ -1823 +2192 @@
         talloc_set_destructor(ctx, libnet_destroy_JoinCtx);
 
-        ctx->in.machine_name = talloc_strdup(mem_ctx, global_myname());
+        ctx->in.machine_name = talloc_strdup(mem_ctx, lp_netbios_name());
         W_ERROR_HAVE_NO_MEMORY(ctx->in.machine_name);
 
         ctx->in.secure_channel_type = SEC_CHAN_WKSTA;
+
+        ctx->in.desired_encryption_types = ENC_CRC32 |
+                                           ENC_RSA_MD5 |
+                                           ENC_RC4_HMAC_MD5;
+#ifdef HAVE_ENCTYPE_AES128_CTS_HMAC_SHA1_96
+        ctx->in.desired_encryption_types |= ENC_HMAC_SHA1_96_AES128;
+#endif
+#ifdef HAVE_ENCTYPE_AES256_CTS_HMAC_SHA1_96
+        ctx->in.desired_encryption_types |= ENC_HMAC_SHA1_96_AES256;
+#endif
 
         *r = ctx;
@@ -1848 +2227 @@
         talloc_set_destructor(ctx, libnet_destroy_UnjoinCtx);
 
-        ctx->in.machine_name = talloc_strdup(mem_ctx, global_myname());
+        ctx->in.machine_name = talloc_strdup(mem_ctx, lp_netbios_name());
         W_ERROR_HAVE_NO_MEMORY(ctx->in.machine_name);
 
@@ -1872 +2251 @@
         switch (r->out.domain_is_ad) {
                 case false:
-                        valid_security = (lp_security() == SEC_DOMAIN);
+                        valid_security = (lp_security() == SEC_DOMAIN)
+                                || (lp_server_role() == ROLE_DOMAIN_PDC)
+                                || (lp_server_role() == ROLE_DOMAIN_BDC);
                         if (valid_workgroup && valid_security) {
                                 /* nothing to be done */
@@ -1916 +2297 @@
                         const char *sec = NULL;
                         switch (lp_security()) {
-                        case SEC_SHARE: sec = "share"; break;
                         case SEC_USER:  sec = "user"; break;
                         case SEC_DOMAIN: sec = "domain"; break;
@@ -1958 +2338 @@
         ADS_STATUS ads_status;
 #endif /* HAVE_ADS */
+        const char *pre_connect_realm = NULL;
+        const char *numeric_dcip = NULL;
+        const char *sitename = NULL;
+
+        /* Before contacting a DC, we can securely know
+         * the realm only if the user specifies it.
+         */
+        if (r->in.use_kerberos &&
+            r->in.domain_name_type == JoinDomNameTypeDNS) {
+                pre_connect_realm = r->in.domain_name;
+        }
 
         if (!r->in.dc_name) {
                 struct netr_DsRGetDCNameInfo *info;
                 const char *dc;
+                uint32_t name_type_flags = 0;
+                if (r->in.domain_name_type == JoinDomNameTypeDNS) {
+                        name_type_flags = DS_IS_DNS_NAME;
+                } else if (r->in.domain_name_type == JoinDomNameTypeNBT) {
+                        name_type_flags = DS_IS_FLAT_NAME;
+                }
                 status = dsgetdcname(mem_ctx,
                                      r->in.msg_ctx,
@@ -1970 +2367 @@
                                      DS_DIRECTORY_SERVICE_REQUIRED |
                                      DS_WRITABLE_REQUIRED |
-                                     DS_RETURN_DNS_NAME,
+                                     DS_RETURN_DNS_NAME |
+                                     name_type_flags,
                                      &info);
                 if (!NT_STATUS_IS_OK(status)) {
@@ -1983 +2381 @@
                 r->in.dc_name = talloc_strdup(mem_ctx, dc);
                 W_ERROR_HAVE_NO_MEMORY(r->in.dc_name);
+
+                if (info->dc_address == NULL || info->dc_address[0] != '\\' ||
+                    info->dc_address[1] != '\\') {
+                        DBG_ERR("ill-formed DC address '%s'\n",
+                                info->dc_address);
+                        return WERR_DCNOTFOUND;
+                }
+
+                numeric_dcip = info->dc_address + 2;
+                sitename = info->dc_site_name;
+                /* info goes out of scope but the memory stays
+                   allocated on the talloc context */
+        }
+
+        if (pre_connect_realm != NULL) {
+                struct sockaddr_storage ss = {0};
+
+                if (numeric_dcip != NULL) {
+                        if (!interpret_string_addr(&ss, numeric_dcip,
+                                                   AI_NUMERICHOST)) {
+                                DBG_ERR(
+                                    "cannot parse IP address '%s' of DC '%s'\n",
+                                    numeric_dcip, r->in.dc_name);
+                                return WERR_DCNOTFOUND;
+                        }
+                } else {
+                        if (!interpret_string_addr(&ss, r->in.dc_name, 0)) {
+                                DBG_WARNING(
+                                    "cannot resolve IP address of DC '%s'\n",
+                                    r->in.dc_name);
+                                return WERR_DCNOTFOUND;
+                        }
+                }
+
+                /* The domain parameter is only used as modifier
+                 * to krb5.conf file name. .JOIN is is not a valid
+                 * NetBIOS name so it cannot clash with another domain
+                 * -- Uri.
+                 */
+                create_local_private_krb5_conf_for_domain(
+                    pre_connect_realm, ".JOIN", sitename, &ss);
         }
 
@@ -2002 +2441 @@
         create_local_private_krb5_conf_for_domain(
                 r->out.dns_domain_name, r->out.netbios_domain_name,
-                NULL, &cli->dest_ss, cli->desthost);
-
-        if (r->out.domain_is_ad && r->in.account_ou &&
+                NULL, smbXcli_conn_remote_sockaddr(cli->conn));
+
+        if (r->out.domain_is_ad &&
             !(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_UNSECURE)) {
 
-                ads_status = libnet_join_connect_ads(mem_ctx, r);
+                const char *initial_account_ou = r->in.account_ou;
+
+                /*
+                 * we want to create the msDS-SupportedEncryptionTypes attribute
+                 * as early as possible so always try an LDAP create as the user
+                 * first. We copy r->in.account_ou because it may be changed
+                 * during the machine pre-creation.
+                 */
+
+                ads_status = libnet_join_connect_ads_user(mem_ctx, r);
                 if (!ADS_ERR_OK(ads_status)) {
                         return WERR_DEFAULT_JOIN_REQUIRED;
@@ -2013 +2461 @@
 
                 ads_status = libnet_join_precreate_machine_acct(mem_ctx, r);
-                if (!ADS_ERR_OK(ads_status)) {
+                if (ADS_ERR_OK(ads_status)) {
+
+                        /*
+                         * LDAP object create succeeded, now go to the rpc
+                         * password set routines
+                         */
+
+                        r->in.join_flags &= ~WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE;
+                        goto rpc_join;
+                }
+
+                if (initial_account_ou != NULL) {
                         libnet_join_set_error_string(mem_ctx, r,
                                 "failed to precreate account in ou %s: %s",
@@ -2021 +2480 @@
                 }
 
-                r->in.join_flags &= ~WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE;
+                DEBUG(5, ("failed to precreate account in ou %s: %s",
+                        r->in.account_ou, ads_errstr(ads_status)));
         }
 #endif /* HAVE_ADS */
 
+ rpc_join:
         if ((r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_UNSECURE) &&
             (r->in.join_flags & WKSSVC_JOIN_FLAGS_MACHINE_PWD_PASSED)) {
@@ -2077 +2538 @@
         u->in.admin_password    = r->in.admin_password;
         u->in.modify_config     = r->in.modify_config;
+        u->in.use_kerberos      = r->in.use_kerberos;
         u->in.unjoin_flags      = WKSSVC_JOIN_FLAGS_JOIN_TYPE |
                                   WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE;
@@ -2261 +2723 @@
         }
 
+        if (!r->in.admin_domain) {
+                char *admin_domain = NULL;
+                char *admin_account = NULL;
+                split_domain_user(mem_ctx,
+                                  r->in.admin_account,
+                                  &admin_domain,
+                                  &admin_account);
+                r->in.admin_domain = admin_domain;
+                r->in.admin_account = admin_account;
+        }
+
         if (!secrets_init()) {
                 libnet_unjoin_set_error_string(mem_ctx, r,

vendor/current/source3/libnet/libnet_join.h

@@ -24 +24 @@
 /* The following definitions come from libnet/libnet_join.c  */
 
-NTSTATUS libnet_join_ok(const char *netbios_domain_name,
-                        const char *machine_name,
-                        const char *dc_name);
+struct messaging_context;
+NTSTATUS libnet_join_ok(struct messaging_context *msg_ctx,
+                        const char *netbios_domain_name,
+                        const char *dc_name,
+                        const bool use_kerberos);
 WERROR libnet_init_JoinCtx(TALLOC_CTX *mem_ctx,
                            struct libnet_JoinCtx **r);

vendor/current/source3/libnet/libnet_keytab.c

@@ -67 +67 @@
         struct libnet_keytab_context *r;
 
-        r = TALLOC_ZERO_P(mem_ctx, struct libnet_keytab_context);
+        r = talloc_zero(mem_ctx, struct libnet_keytab_context);
         if (!r) {
                 return ENOMEM;

vendor/current/source3/libnet/libnet_keytab.h

@@ -28 +28 @@
 };
 
+struct ads_struct;
+
 struct libnet_keytab_context {
         krb5_context context;
         krb5_keytab keytab;
         const char *keytab_name;
-        ADS_STRUCT *ads;
+        struct ads_struct *ads;
         const char *dns_domain_name;
         uint8_t zero_buf[16];

vendor/current/source3/libnet/libnet_samsync.c

@@ -31 +31 @@
 #include "../libcli/security/security.h"
 #include "messages.h"
+#include "../libcli/auth/netlogon_creds_cli.h"
 
 /**
@@ -71 +72 @@
         *ctx_p = NULL;
 
-        ctx = TALLOC_ZERO_P(mem_ctx, struct samsync_context);
+        ctx = talloc_zero(mem_ctx, struct samsync_context);
         NT_STATUS_HAVE_NO_MEMORY(ctx);
 
@@ -82 +83 @@
         }
 
-        ctx->msg_ctx = messaging_init(ctx, procid_self(),
-                                      event_context_init(ctx));
+        ctx->msg_ctx = messaging_init(ctx, samba_tevent_context_init(ctx));
         NT_STATUS_HAVE_NO_MEMORY(ctx->msg_ctx);
 
@@ -204 +204 @@
         NTSTATUS callback_status;
         const char *logon_server = ctx->cli->desthost;
-        const char *computername = global_myname();
+        const char *computername = lp_netbios_name();
         struct netr_Authenticator credential;
         struct netr_Authenticator return_authenticator;
@@ -215 +215 @@
         do {
                 struct netr_DELTA_ENUM_ARRAY *delta_enum_array = NULL;
-
-                netlogon_creds_client_authenticator(ctx->cli->dc, &credential);
+                struct netlogon_creds_CredentialState *creds = NULL;
+
+                status = netlogon_creds_cli_lock(ctx->netlogon_creds,
+                                                 mem_ctx, &creds);
+                if (!NT_STATUS_IS_OK(status)) {
+                        return status;
+                }
+
+                netlogon_creds_client_authenticator(creds, &credential);
 
                 if (ctx->single_object_replication &&
@@ -256 +263 @@
 
                 if (!NT_STATUS_IS_OK(status)) {
+                        TALLOC_FREE(creds);
                         return status;
                 }
 
                 /* Check returned credentials. */
-                if (!netlogon_creds_client_check(ctx->cli->dc,
+                if (!netlogon_creds_client_check(creds,
                                                  &return_authenticator.cred)) {
+                        TALLOC_FREE(creds);
                         DEBUG(0,("credentials chain check failed\n"));
                         return NT_STATUS_ACCESS_DENIED;
@@ -267 +276 @@
 
                 if (NT_STATUS_EQUAL(result, NT_STATUS_NOT_SUPPORTED)) {
+                        TALLOC_FREE(creds);
                         return result;
                 }
 
                 if (NT_STATUS_IS_ERR(result)) {
+                        TALLOC_FREE(creds);
                         break;
                 }
 
                 samsync_fix_delta_array(mem_ctx,
-                                        ctx->cli->dc,
+                                        creds,
                                         database_id,
                                         delta_enum_array);
+                TALLOC_FREE(creds);
 
                 /* Process results */
@@ -405 +417 @@
         *str_p = NULL;
 
-        str = TALLOC_ZERO_P(mem_ctx, struct netr_AcctLockStr);
+        str = talloc_zero(mem_ctx, struct netr_AcctLockStr);
         if (!str) {
                 return NT_STATUS_NO_MEMORY;

vendor/current/source3/libnet/libnet_samsync.h

@@ -76 +76 @@
 
         struct rpc_pipe_client *cli;
+        struct netlogon_creds_cli_context *netlogon_creds;
         struct messaging_context *msg_ctx;
 

vendor/current/source3/libnet/libnet_samsync_display.c

@@ -99 +99 @@
         }
 
-        u_logout = uint64s_nt_time_to_unix_abs((const uint64 *)&r->force_logoff_time);
+        u_logout = uint64s_nt_time_to_unix_abs((const uint64_t *)&r->force_logoff_time);
 
         d_printf("Domain name: %s\n", r->domain_name.string);

vendor/current/source3/libnet/libnet_samsync_ldif.c

@@ -25 +25 @@
 
 #include "includes.h"
+#include "system/filesys.h"
 #include "libnet/libnet_samsync.h"
-#include "smbldap.h"
 #include "transfer_file.h"
 #include "passdb.h"
+#include "passdb/pdb_ldap_schema.h"
 
 #ifdef HAVE_LDAP
 
 /* uid's and gid's for writing deltas to ldif */
-static uint32 ldif_gid = 999;
-static uint32 ldif_uid = 999;
+static uint32_t ldif_gid = 999;
+static uint32_t ldif_uid = 999;
 
 /* global counters */
@@ -69 +70 @@
 };
 
+/*
+   Returns the substring from src between the first occurrence of
+   the char "front" and the first occurence of the char "back".
+   Mallocs the return string which must be freed.  Not for use
+   with wide character strings.
+*/
+static char *sstring_sub(const char *src, char front, char back)
+{
+        char *temp1, *temp2, *temp3;
+        ptrdiff_t len;
+
+        temp1 = strchr(src, front);
+        if (temp1 == NULL) return NULL;
+        temp2 = strchr(src, back);
+        if (temp2 == NULL) return NULL;
+        len = temp2 - temp1;
+        if (len <= 0) return NULL;
+        temp3 = (char*)SMB_MALLOC(len);
+        if (temp3 == NULL) {
+                DEBUG(1,("Malloc failure in sstring_sub\n"));
+                return NULL;
+        }
+        memcpy(temp3, temp1+1, len-1);
+        temp3[len-1] = '\0';
+        return temp3;
+}
+
 /****************************************************************
 ****************************************************************/
@@ -104 +132 @@
         fflush(add_fd);
 
-        user_suffix = lp_ldap_user_suffix();
+        user_suffix = lp_ldap_user_suffix(talloc_tos());
         if (user_suffix == NULL) {
                 SAFE_FREE(suffix_attr);
@@ -112 +140 @@
            Write the Users entity */
         if (*user_suffix && strcmp(user_suffix, suffix)) {
-                user_attr = sstring_sub(lp_ldap_user_suffix(), '=', ',');
+                user_attr = sstring_sub(lp_ldap_user_suffix(talloc_tos()), '=', ',');
                 fprintf(add_fd, "# %s\n", user_suffix);
                 fprintf(add_fd, "dn: %s\n", user_suffix);
@@ -122 +150 @@
 
 
-        group_suffix = lp_ldap_group_suffix();
+        group_suffix = lp_ldap_group_suffix(talloc_tos());
         if (group_suffix == NULL) {
                 SAFE_FREE(suffix_attr);
@@ -131 +159 @@
            Write the Groups entity */
         if (*group_suffix && strcmp(group_suffix, suffix)) {
-                group_attr = sstring_sub(lp_ldap_group_suffix(), '=', ',');
+                group_attr = sstring_sub(lp_ldap_group_suffix(talloc_tos()), '=', ',');
                 fprintf(add_fd, "# %s\n", group_suffix);
                 fprintf(add_fd, "dn: %s\n", group_suffix);
@@ -142 +170 @@
         /* If it exists and is distinct from other containers,
            Write the Computers entity */
-        machine_suffix = lp_ldap_machine_suffix();
+        machine_suffix = lp_ldap_machine_suffix(talloc_tos());
         if (machine_suffix == NULL) {
                 SAFE_FREE(suffix_attr);
@@ -157 +185 @@
                 /* this isn't totally correct as it assumes that
                    there _must_ be an ou. just fixing memleak now. jmcd */
-                machine_ou = sstring_sub(lp_ldap_machine_suffix(), '=', ',');
+                machine_ou = sstring_sub(lp_ldap_machine_suffix(talloc_tos()), '=', ',');
                 fprintf(add_fd, "ou: %s\n", machine_ou);
                 SAFE_FREE(machine_ou);
@@ -166 +194 @@
         /* If it exists and is distinct from other containers,
            Write the IdMap entity */
-        idmap_suffix = lp_ldap_idmap_suffix();
+        idmap_suffix = lp_ldap_idmap_suffix(talloc_tos());
         if (idmap_suffix == NULL) {
                 SAFE_FREE(suffix_attr);
@@ -180 +208 @@
                 fprintf(add_fd, "dn: %s\n", idmap_suffix);
                 fprintf(add_fd, "ObjectClass: organizationalUnit\n");
-                s = sstring_sub(lp_ldap_idmap_suffix(), '=', ',');
+                s = sstring_sub(lp_ldap_idmap_suffix(talloc_tos()), '=', ',');
                 fprintf(add_fd, "ou: %s\n", s);
                 SAFE_FREE(s);
@@ -344 +372 @@
                                     const char *builtin_sid)
 {
-        char *group_attr = sstring_sub(lp_ldap_group_suffix(), '=', ',');
+        char *group_attr = sstring_sub(lp_ldap_group_suffix(talloc_tos()), '=', ',');
 
         /* Map the groups created by populate_ldap_for_ldif */
@@ -549 +577 @@
 {
         const char *groupname = r->group_name.string;
-        uint32 grouptype = 0, g_rid = 0;
-        char *group_attr = sstring_sub(lp_ldap_group_suffix(), '=', ',');
+        uint32_t grouptype = 0, g_rid = 0;
+        char *group_attr = sstring_sub(lp_ldap_group_suffix(talloc_tos()), '=', ',');
 
         /* Set up the group type (always 2 for group info) */
@@ -622 +650 @@
         const char* nopasswd = "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX";
         uchar zero_buf[16];
-        uint32 rid = 0, group_rid = 0, gidNumber = 0;
+        uint32_t rid = 0, group_rid = 0, gidNumber = 0;
         time_t unix_time;
         int i, ret;
@@ -647 +675 @@
                         snprintf(homedir, sizeof(homedir), "/nobodyshomedir");
                 }
-                ou = lp_ldap_user_suffix();
+                ou = lp_ldap_user_suffix(talloc_tos());
         } else {
-                ou = lp_ldap_machine_suffix();
+                ou = lp_ldap_machine_suffix(talloc_tos());
                 snprintf(homedir, sizeof(homedir), "/machinehomedir");
         }
@@ -768 +796 @@
 {
         fstring aliasname, description;
-        uint32 grouptype = 0, g_rid = 0;
-        char *group_attr = sstring_sub(lp_ldap_group_suffix(), '=', ',');
+        uint32_t grouptype = 0, g_rid = 0;
+        char *group_attr = sstring_sub(lp_ldap_group_suffix(talloc_tos()), '=', ',');
 
         /* Get the alias name */
@@ -851 +879 @@
 {
         fstring group_dn;
-        uint32 group_rid = 0, rid = 0;
+        uint32_t group_rid = 0, rid = 0;
         int i, j, k;
 
@@ -903 +931 @@
         const char *mod_template = "/tmp/mod.ldif.XXXXXX";
         const char *builtin_sid = "S-1-5-32";
+        mode_t mask;
+        int fd;
+
+        r = talloc_zero(mem_ctx, struct samsync_ldif_context);
+        NT_STATUS_HAVE_NO_MEMORY(r);
+
+        /* Get the ldap suffix */
+        r->suffix = lp_ldap_suffix(talloc_tos());
 
         /* Get other smb.conf data */
@@ -911 +947 @@
 
         /* Get the ldap suffix */
-        if (!(lp_ldap_suffix()) || !*(lp_ldap_suffix())) {
+        if (!r->suffix || !*r->suffix) {
                 DEBUG(0,("ldap suffix missing from smb.conf--exiting\n"));
                 exit(1);
@@ -919 +955 @@
                 return NT_STATUS_OK;
         }
-
-        r = TALLOC_ZERO_P(mem_ctx, struct samsync_ldif_context);
-        NT_STATUS_HAVE_NO_MEMORY(r);
-
-        /* Get the ldap suffix */
-        r->suffix = lp_ldap_suffix();
 
         /* Ensure we have an output file */
@@ -954 +984 @@
         }
 
-        /* Open the add and mod ldif files */
-        if (!(r->add_file = fdopen(mkstemp(r->add_name),"w"))) {
-                DEBUG(1, ("Could not open %s\n", r->add_name));
+        mask = umask(S_IRWXO | S_IRWXG);
+        fd = mkstemp(r->add_name);
+        umask(mask);
+        if (fd < 0) {
+                DEBUG(1, ("Could not create %s\n", r->add_name));
                 status = NT_STATUS_UNSUCCESSFUL;
                 goto done;
         }
-        if (!(r->mod_file = fdopen(mkstemp(r->module_name),"w"))) {
-                DEBUG(1, ("Could not open %s\n", r->module_name));
+
+        /* Open the add and mod ldif files */
+        r->add_file = fdopen(fd, "w");
+        if (r->add_file == NULL) {
+                DEBUG(1, ("Could not open %s\n", r->add_name));
+                close(fd);
                 status = NT_STATUS_UNSUCCESSFUL;
                 goto done;
         }
 
+        mask = umask(S_IRWXO | S_IRWXG);
+        fd = mkstemp(r->module_name);
+        umask(mask);
+        if (fd < 0) {
+                DEBUG(1, ("Could not create %s\n", r->module_name));
+                status = NT_STATUS_UNSUCCESSFUL;
+                goto done;
+        }
+
+        r->mod_file = fdopen(fd, "w");
+        if (r->mod_file == NULL) {
+                DEBUG(1, ("Could not open %s\n", r->module_name));
+                close(fd);
+                status = NT_STATUS_UNSUCCESSFUL;
+                goto done;
+        }
+
         /* Allocate initial memory for groupmap and accountmap arrays */
-        r->groupmap = TALLOC_ZERO_ARRAY(mem_ctx, GROUPMAP, 8);
-        r->accountmap = TALLOC_ZERO_ARRAY(mem_ctx, ACCOUNTMAP, 8);
+        r->groupmap = talloc_zero_array(mem_ctx, GROUPMAP, 8);
+        r->accountmap = talloc_zero_array(mem_ctx, ACCOUNTMAP, 8);
         if (r->groupmap == NULL || r->accountmap == NULL) {
                 DEBUG(1,("GROUPMAP talloc failed\n"));
@@ -1174 +1227 @@
 {
         /* Re-allocate memory for groupmap and accountmap arrays */
-        l->groupmap = TALLOC_REALLOC_ARRAY(mem_ctx,
+        l->groupmap = talloc_realloc(mem_ctx,
                                            l->groupmap,
                                            GROUPMAP,
                                            num_entries + l->num_alloced);
 
-        l->accountmap = TALLOC_REALLOC_ARRAY(mem_ctx,
+        l->accountmap = talloc_realloc(mem_ctx,
                                              l->accountmap,
                                              ACCOUNTMAP,

vendor/current/source3/libnet/libnet_samsync_passdb.c

@@ -251 +251 @@
         /* Create appropriate user */
         if (acct_flags & ACB_NORMAL) {
-                add_script = talloc_strdup(mem_ctx, lp_adduser_script());
+                add_script = lp_add_user_script(mem_ctx);
         } else if ( (acct_flags & ACB_WSTRUST) ||
                     (acct_flags & ACB_SVRTRUST) ||
                     (acct_flags & ACB_DOMTRUST) ) {
-                add_script = talloc_strdup(mem_ctx, lp_addmachine_script());
+                add_script = lp_add_machine_script(mem_ctx);
         } else {
                 DEBUG(1, ("Unknown user type: %s\n",
@@ -302 +302 @@
         fstring account;
         struct samu *sam_account=NULL;
-        GROUP_MAP map;
+        GROUP_MAP *map = NULL;
         struct group *grp;
         struct dom_sid user_sid;
@@ -356 +356 @@
         group_sid = *pdb_get_group_sid(sam_account);
 
-        if (!pdb_getgrsid(&map, group_sid)) {
+        map = talloc_zero(mem_ctx, GROUP_MAP);
+        if (!map) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        if (!pdb_getgrsid(map, group_sid)) {
                 DEBUG(0, ("Primary group of %s has no mapping!\n",
                           pdb_get_username(sam_account)));
         } else {
-                if (map.gid != passwd->pw_gid) {
-                        if (!(grp = getgrgid(map.gid))) {
+                if (map->gid != passwd->pw_gid) {
+                        if (!(grp = getgrgid(map->gid))) {
                                 DEBUG(0, ("Could not find unix group %lu for user %s (group SID=%s)\n",
-                                          (unsigned long)map.gid, pdb_get_username(sam_account), sid_string_tos(&group_sid)));
+                                          (unsigned long)map->gid, pdb_get_username(sam_account), sid_string_tos(&group_sid)));
                         } else {
                                 smb_set_primary_group(grp->gr_name, pdb_get_username(sam_account));
@@ -377 +382 @@
  done:
         TALLOC_FREE(sam_account);
+        TALLOC_FREE(map);
         return nt_ret;
 }
@@ -387 +393 @@
                                  struct netr_DELTA_GROUP *r)
 {
-        fstring name;
-        fstring comment;
         struct group *grp = NULL;
         struct dom_sid group_sid;
         fstring sid_string;
-        GROUP_MAP map;
+        GROUP_MAP *map;
         bool insert = true;
 
-        fstrcpy(name, r->group_name.string);
-        fstrcpy(comment, r->description.string);
-
+        map = talloc_zero(mem_ctx, GROUP_MAP);
+        if (!map) {
+                return NT_STATUS_NO_MEMORY;
+        }
         /* add the group to the mapping table */
         sid_compose(&group_sid, get_global_sam_sid(), rid);
         sid_to_fstring(sid_string, &group_sid);
 
-        if (pdb_getgrsid(&map, group_sid)) {
-                if ( map.gid != -1 )
-                        grp = getgrgid(map.gid);
+        if (pdb_getgrsid(map, group_sid)) {
+                if (map->gid != -1) {
+                        grp = getgrgid(map->gid);
+                }
                 insert = false;
+        }
+
+        map->nt_name = talloc_strdup(map, r->group_name.string);
+        if (!map->nt_name) {
+                return NT_STATUS_NO_MEMORY;
+        }
+        map->comment = talloc_strdup(map, r->description.string);
+        if (!map->comment) {
+                return NT_STATUS_NO_MEMORY;
         }
 
@@ -412 +427 @@
 
                 /* No group found from mapping, find it from its name. */
-                if ((grp = getgrnam(name)) == NULL) {
+                if ((grp = getgrnam(map->nt_name)) == NULL) {
 
                         /* No appropriate group found, create one */
 
-                        d_printf("Creating unix group: '%s'\n", name);
-
-                        if (smb_create_group(name, &gid) != 0)
+                        d_printf("Creating unix group: '%s'\n", map->nt_name);
+
+                        if (smb_create_group(map->nt_name, &gid) != 0)
                                 return NT_STATUS_ACCESS_DENIED;
 
-                        if ((grp = getgrnam(name)) == NULL)
+                        if ((grp = getgrnam(map->nt_name)) == NULL)
                                 return NT_STATUS_ACCESS_DENIED;
                 }
         }
 
-        map.gid = grp->gr_gid;
-        map.sid = group_sid;
-        map.sid_name_use = SID_NAME_DOM_GRP;
-        fstrcpy(map.nt_name, name);
-        if (r->description.string) {
-                fstrcpy(map.comment, comment);
+        map->gid = grp->gr_gid;
+        map->sid = group_sid;
+        map->sid_name_use = SID_NAME_DOM_GRP;
+
+        if (insert) {
+                pdb_add_group_mapping_entry(map);
         } else {
-                fstrcpy(map.comment, "");
-        }
-
-        if (insert)
-                pdb_add_group_mapping_entry(&map);
-        else
-                pdb_update_group_mapping_entry(&map);
-
+                pdb_update_group_mapping_entry(map);
+        }
+
+        TALLOC_FREE(map);
         return NT_STATUS_OK;
 }
@@ -455 +466 @@
         char **unix_members;
         struct dom_sid group_sid;
-        GROUP_MAP map;
+        GROUP_MAP *map;
         struct group *grp;
 
@@ -464 +475 @@
         sid_compose(&group_sid, get_global_sam_sid(), rid);
 
-        if (!get_domain_group_from_sid(group_sid, &map)) {
+        map = talloc_zero(mem_ctx, GROUP_MAP);
+        if (!map) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        if (!get_domain_group_from_sid(group_sid, map)) {
                 DEBUG(0, ("Could not find global group %d\n", rid));
+                TALLOC_FREE(map);
                 return NT_STATUS_NO_SUCH_GROUP;
         }
 
-        if (!(grp = getgrgid(map.gid))) {
-                DEBUG(0, ("Could not find unix group %lu\n", (unsigned long)map.gid));
+        if (!(grp = getgrgid(map->gid))) {
+                DEBUG(0, ("Could not find unix group %lu\n",
+                                                (unsigned long)map->gid));
+                TALLOC_FREE(map);
                 return NT_STATUS_NO_SUCH_GROUP;
         }
 
+        TALLOC_FREE(map);
+
         d_printf("Group members of %s: ", grp->gr_name);
 
         if (r->num_rids) {
-                if ((nt_members = TALLOC_ZERO_ARRAY(mem_ctx, char *, r->num_rids)) == NULL) {
+                if ((nt_members = talloc_zero_array(mem_ctx, char *, r->num_rids)) == NULL) {
                         DEBUG(0, ("talloc failed\n"));
                         return NT_STATUS_NO_MEMORY;
@@ -576 +597 @@
                                  const struct dom_sid *dom_sid)
 {
-        fstring name;
-        fstring comment;
         struct group *grp = NULL;
         struct dom_sid alias_sid;
         fstring sid_string;
-        GROUP_MAP map;
+        GROUP_MAP *map;
         bool insert = true;
 
-        fstrcpy(name, r->alias_name.string);
-        fstrcpy(comment, r->description.string);
+        map = talloc_zero(mem_ctx, GROUP_MAP);
+        if (!map) {
+                return NT_STATUS_NO_MEMORY;
+        }
 
         /* Find out whether the group is already mapped */
@@ -591 +612 @@
         sid_to_fstring(sid_string, &alias_sid);
 
-        if (pdb_getgrsid(&map, alias_sid)) {
-                grp = getgrgid(map.gid);
+        if (pdb_getgrsid(map, alias_sid)) {
+                grp = getgrgid(map->gid);
                 insert = false;
+        }
+
+        map->nt_name = talloc_strdup(map, r->alias_name.string);
+        if (!map->nt_name) {
+                return NT_STATUS_NO_MEMORY;
+        }
+        map->comment = talloc_strdup(map, r->description.string);
+        if (!map->comment) {
+                return NT_STATUS_NO_MEMORY;
         }
 
@@ -600 +630 @@
 
                 /* No group found from mapping, find it from its name. */
-                if ((grp = getgrnam(name)) == NULL) {
+                if ((grp = getgrnam(map->nt_name)) == NULL) {
                         /* No appropriate group found, create one */
-                        d_printf("Creating unix group: '%s'\n", name);
-                        if (smb_create_group(name, &gid) != 0)
+                        d_printf("Creating unix group: '%s'\n", map->nt_name);
+                        if (smb_create_group(map->nt_name, &gid) != 0)
                                 return NT_STATUS_ACCESS_DENIED;
                         if ((grp = getgrgid(gid)) == NULL)
@@ -610 +640 @@
         }
 
-        map.gid = grp->gr_gid;
-        map.sid = alias_sid;
-
-        if (dom_sid_equal(dom_sid, &global_sid_Builtin))
-                map.sid_name_use = SID_NAME_WKN_GRP;
-        else
-                map.sid_name_use = SID_NAME_ALIAS;
-
-        fstrcpy(map.nt_name, name);
-        fstrcpy(map.comment, comment);
-
-        if (insert)
-                pdb_add_group_mapping_entry(&map);
-        else
-                pdb_update_group_mapping_entry(&map);
-
+        map->gid = grp->gr_gid;
+        map->sid = alias_sid;
+
+        if (dom_sid_equal(dom_sid, &global_sid_Builtin)) {
+                map->sid_name_use = SID_NAME_WKN_GRP;
+        } else {
+                map->sid_name_use = SID_NAME_ALIAS;
+        }
+
+        if (insert) {
+                pdb_add_group_mapping_entry(map);
+        } else {
+                pdb_update_group_mapping_entry(map);
+        }
+
+        TALLOC_FREE(map);
         return NT_STATUS_OK;
 }
@@ -660 +690 @@
         }
 
-        u_max_age = uint64s_nt_time_to_unix_abs((uint64 *)&r->max_password_age);
-        u_min_age = uint64s_nt_time_to_unix_abs((uint64 *)&r->min_password_age);
-        u_logout = uint64s_nt_time_to_unix_abs((uint64 *)&r->force_logoff_time);
+        u_max_age = uint64s_nt_time_to_unix_abs((uint64_t *)&r->max_password_age);
+        u_min_age = uint64s_nt_time_to_unix_abs((uint64_t *)&r->min_password_age);
+        u_logout = uint64s_nt_time_to_unix_abs((uint64_t *)&r->force_logoff_time);
 
         domname = r->domain_name.string;
@@ -685 +715 @@
 
         if (!pdb_set_account_policy(PDB_POLICY_MAX_PASSWORD_AGE,
-                                    (uint32)u_max_age))
+                                    (uint32_t)u_max_age))
                 return nt_status;
 
         if (!pdb_set_account_policy(PDB_POLICY_MIN_PASSWORD_AGE,
-                                    (uint32)u_min_age))
+                                    (uint32_t)u_min_age))
                 return nt_status;
 
         if (!pdb_set_account_policy(PDB_POLICY_TIME_TO_LOGOUT,
-                                    (uint32)u_logout))
+                                    (uint32_t)u_logout))
                 return nt_status;