Merge branch 'v4-0-test' of ssh://git.samba.org/data/git/samba into pac-verify

(This used to be commit b706708210a05d6f10474a3cd2bbc550704d4356)

9 files changed, 271 insertions, 28 deletions

diff --git a/source4/libcli/config.mk b/source4/libcli/config.mk
index affd8e277d..262a2cfa22 100644
--- a/source4/libcli/config.mk
+++ b/source4/libcli/config.mk
@@ -73,6 +73,14 @@ LIBCLI_NETLOGON_OBJ_FILES = $(addprefix $(libclisrcdir)/, \
 
 $(eval $(call proto_header_template,$(libclisrcdir)/netlogon_proto.h,$(LIBCLI_NETLOGON_OBJ_FILES:.o=.c)))
 
+[SUBSYSTEM::LIBCLI_DRSBLOBS]
+PUBLIC_DEPENDENCIES = LIBNDR 
+
+LIBCLI_DRSBLOBS_OBJ_FILES = $(addprefix $(libclisrcdir)/, \
+	drsblobs.o)
+
+$(eval $(call proto_header_template,$(libclisrcdir)/drsblobs_proto.h,$(LIBCLI_DRSBLOBS_OBJ_FILES:.o=.c)))
+
 [PYTHON::python_netbios]
 LIBRARY_REALNAME = samba/netbios.$(SHLIBEXT)
 PUBLIC_DEPENDENCIES = LIBCLI_NBT DYNCONFIG LIBSAMBA-HOSTCONFIG
diff --git a/source4/libcli/drsblobs.c b/source4/libcli/drsblobs.c
new file mode 100644
index 0000000000..126f2ccc40
--- /dev/null
+++ b/source4/libcli/drsblobs.c
@@ -0,0 +1,179 @@
+/* 
+   Unix SMB/CIFS implementation.
+
+   Manually parsed structures found in the DRS protocol
+
+   Copyright (C) Andrew Bartlett <abartlet@samba.org> 2008
+   
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+   
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+   
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "includes.h"
+#include "libcli/drsblobs.h"
+
+/* parser auto-generated by pidl, then hand-modified by abartlet */
+
+/* Modified to have 'count' specified */
+static enum ndr_err_code ndr_push_AuthenticationInformationArray_with_count(struct ndr_push *ndr, int ndr_flags, int count, 
+								 const struct AuthenticationInformationArray *r)
+{
+	uint32_t cntr_array_0;
+	if (ndr_flags & NDR_SCALARS) {
+		NDR_CHECK(ndr_push_align(ndr, 4));
+		for (cntr_array_0 = 0; cntr_array_0 < count; cntr_array_0++) {
+			NDR_CHECK(ndr_push_AuthenticationInformation(ndr, NDR_SCALARS, &r->array[cntr_array_0]));
+		}
+	}
+	if (ndr_flags & NDR_BUFFERS) {
+		for (cntr_array_0 = 0; cntr_array_0 < count; cntr_array_0++) {
+			NDR_CHECK(ndr_push_AuthenticationInformation(ndr, NDR_BUFFERS, &r->array[cntr_array_0]));
+		}
+	}
+	return NDR_ERR_SUCCESS;
+}
+
+/* Modified to have 'count' specified, and to allocate the array */
+static enum ndr_err_code ndr_pull_AuthenticationInformationArray_with_count(struct ndr_pull *ndr, int ndr_flags, int count, struct AuthenticationInformationArray *r)
+{
+	uint32_t cntr_array_0;
+	TALLOC_CTX *_mem_save_array_0;
+	if (ndr_flags & NDR_SCALARS) {
+		NDR_CHECK(ndr_pull_align(ndr, 4));
+		NDR_PULL_ALLOC_N(ndr, r->array, count);
+		_mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+		NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+		for (cntr_array_0 = 0; cntr_array_0 < count; cntr_array_0++) {
+			NDR_CHECK(ndr_pull_AuthenticationInformation(ndr, NDR_SCALARS, &r->array[cntr_array_0]));
+		}
+		NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_0, 0);
+	}
+	if (ndr_flags & NDR_BUFFERS) {
+		for (cntr_array_0 = 0; cntr_array_0 < count; cntr_array_0++) {
+			NDR_CHECK(ndr_pull_AuthenticationInformation(ndr, NDR_BUFFERS, &r->array[cntr_array_0]));
+		}
+	}
+	return NDR_ERR_SUCCESS;
+}
+
+/* Modified to have 'count' specified */
+_PUBLIC_ void ndr_print_AuthenticationInformationArray_with_count(struct ndr_print *ndr, const char *name, int count, const struct AuthenticationInformationArray *r)
+{
+	uint32_t cntr_array_0;
+	ndr_print_struct(ndr, name, "AuthenticationInformationArray");
+	ndr->depth++;
+	ndr->print(ndr, "%s: ARRAY(%d)", "array", (int)1);
+	ndr->depth++;
+	for (cntr_array_0=0;cntr_array_0<count;cntr_array_0++) {
+		char *idx_0=NULL;
+		if (asprintf(&idx_0, "[%d]", cntr_array_0) != -1) {
+			ndr_print_AuthenticationInformation(ndr, "array", &r->array[cntr_array_0]);
+			free(idx_0);
+		}
+	}
+	ndr->depth--;
+	ndr->depth--;
+}
+
+/* Modified to call AuthenticationInformationArray with 'count' specified */
+_PUBLIC_ enum ndr_err_code ndr_push_trustAuthInOutBlob(struct ndr_push *ndr, int ndr_flags, const struct trustAuthInOutBlob *r)
+{
+	if (ndr_flags & NDR_SCALARS) {
+		NDR_CHECK(ndr_push_align(ndr, 4));
+		NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, r->count));
+		NDR_CHECK(ndr_push_relative_ptr1(ndr, r->current));
+		NDR_CHECK(ndr_push_relative_ptr1(ndr, r->previous));
+	}
+	if (ndr_flags & NDR_BUFFERS) {
+		if (r->current) {
+			NDR_CHECK(ndr_push_relative_ptr2(ndr, r->current));
+			NDR_CHECK(ndr_push_AuthenticationInformationArray_with_count(ndr, NDR_SCALARS|NDR_BUFFERS, r->count, r->current));
+		}
+		if (r->previous) {
+			NDR_CHECK(ndr_push_relative_ptr2(ndr, r->previous));
+			NDR_CHECK(ndr_push_AuthenticationInformationArray_with_count(ndr, NDR_SCALARS|NDR_BUFFERS, r->count, r->previous));
+		}
+	}
+	return NDR_ERR_SUCCESS;
+}
+
+_PUBLIC_ enum ndr_err_code ndr_pull_trustAuthInOutBlob(struct ndr_pull *ndr, int ndr_flags, struct trustAuthInOutBlob *r)
+{
+	uint32_t _ptr_current;
+	TALLOC_CTX *_mem_save_current_0;
+	uint32_t _ptr_previous;
+	TALLOC_CTX *_mem_save_previous_0;
+	if (ndr_flags & NDR_SCALARS) {
+		NDR_CHECK(ndr_pull_align(ndr, 4));
+		NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->count));
+		NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_current));
+		if (_ptr_current) {
+			NDR_PULL_ALLOC(ndr, r->current);
+			NDR_CHECK(ndr_pull_relative_ptr1(ndr, r->current, _ptr_current));
+		} else {
+			r->current = NULL;
+		}
+		NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_previous));
+		if (_ptr_previous) {
+			NDR_PULL_ALLOC(ndr, r->previous);
+			NDR_CHECK(ndr_pull_relative_ptr1(ndr, r->previous, _ptr_previous));
+		} else {
+			r->previous = NULL;
+		}
+	}
+	if (ndr_flags & NDR_BUFFERS) {
+		if (r->current) {
+			uint32_t _relative_save_offset;
+			_relative_save_offset = ndr->offset;
+			NDR_CHECK(ndr_pull_relative_ptr2(ndr, r->current));
+			_mem_save_current_0 = NDR_PULL_GET_MEM_CTX(ndr);
+			NDR_PULL_SET_MEM_CTX(ndr, r->current, 0);
+			NDR_CHECK(ndr_pull_AuthenticationInformationArray_with_count(ndr, NDR_SCALARS|NDR_BUFFERS, r->count, r->current));
+			NDR_PULL_SET_MEM_CTX(ndr, _mem_save_current_0, 0);
+			ndr->offset = _relative_save_offset;
+		}
+		if (r->previous) {
+			uint32_t _relative_save_offset;
+			_relative_save_offset = ndr->offset;
+			NDR_CHECK(ndr_pull_relative_ptr2(ndr, r->previous));
+			_mem_save_previous_0 = NDR_PULL_GET_MEM_CTX(ndr);
+			NDR_PULL_SET_MEM_CTX(ndr, r->previous, 0);
+			NDR_CHECK(ndr_pull_AuthenticationInformationArray_with_count(ndr, NDR_SCALARS|NDR_BUFFERS, r->count, r->previous));
+			NDR_PULL_SET_MEM_CTX(ndr, _mem_save_previous_0, 0);
+			ndr->offset = _relative_save_offset;
+		}
+	}
+	return NDR_ERR_SUCCESS;
+}
+
+_PUBLIC_ void ndr_print_trustAuthInOutBlob(struct ndr_print *ndr, const char *name, const struct trustAuthInOutBlob *r)
+{
+	ndr_print_struct(ndr, name, "trustAuthInOutBlob");
+	ndr->depth++;
+	ndr_print_uint32(ndr, "count", r->count);
+	ndr_print_ptr(ndr, "current", r->current);
+	ndr->depth++;
+	if (r->current) {
+		ndr_print_AuthenticationInformationArray_with_count(ndr, "current", r->count, r->current);
+	}
+	ndr->depth--;
+	ndr_print_ptr(ndr, "previous", r->previous);
+	ndr->depth++;
+	if (r->previous) {
+		ndr_print_AuthenticationInformationArray_with_count(ndr, "previous", r->count, r->previous);
+	}
+	ndr->depth--;
+	ndr->depth--;
+}
+
+
diff --git a/source4/libcli/drsblobs.h b/source4/libcli/drsblobs.h
new file mode 100644
index 0000000000..8fee4114be
--- /dev/null
+++ b/source4/libcli/drsblobs.h
@@ -0,0 +1,28 @@
+/* 
+   Unix SMB/CIFS implementation.
+
+   Manually parsed structures found in the DRS protocol
+
+   Copyright (C) Andrew Bartlett <abartlet@samba.org> 2008
+   
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+   
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+   
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#ifndef __LIBCLI_DRSBLOBS_H__
+#define __LIBCLI_DRSBLOBS_H__
+
+#include "librpc/gen_ndr/ndr_drsblobs.h"
+
+#include "libcli/drsblobs_proto.h"
+#endif /* __CLDAP_SERVER_PROTO_H__ */
diff --git a/source4/libcli/raw/smb.h b/source4/libcli/raw/smb.h
index 8663792f78..d4091acf48 100644
--- a/source4/libcli/raw/smb.h
+++ b/source4/libcli/raw/smb.h
@@ -167,17 +167,30 @@
 #define NTCREATEX_OPTIONS_NO_RECALL             0x00400000
 /* Must be ignored by the server, per MS-SMB 2.2.8 */
 #define NTCREATEX_OPTIONS_FREE_SPACE_QUERY      0x00800000
-/* create options these bits are for private use by backends, they are
-   not valid on the wire */
-#define NTCREATEX_OPTIONS_PRIVATE_MASK          0xFF000000
-#define NTCREATEX_OPTIONS_PRIVATE_DENY_DOS      0x01000000
-#define NTCREATEX_OPTIONS_PRIVATE_DENY_FCB      0x02000000
 
-#define NTCREATEX_OPTIONS_MUST_IGNORE_MASK      ( NTCREATEX_OPTIONS_TREE_CONNECTION | NTCREATEX_OPTIONS_COMPLETE_IF_OPLOCKED | NTCREATEX_OPTIONS_OPEN_FOR_RECOVERY | NTCREATEX_OPTIONS_FREE_SPACE_QUERY | NTCREATEX_OPTIONS_OPFILTER )
+#define NTCREATEX_OPTIONS_MUST_IGNORE_MASK      (NTCREATEX_OPTIONS_TREE_CONNECTION | \
+						 NTCREATEX_OPTIONS_OPEN_FOR_RECOVERY | \
+						 NTCREATEX_OPTIONS_FREE_SPACE_QUERY | \
+						 0x000F0000)
 
-#define NTCREATEX_OPTIONS_NOT_SUPPORTED_MASK    (0x000F0000 | NTCREATEX_OPTIONS_OPEN_BY_FILE_ID)
+#define NTCREATEX_OPTIONS_NOT_SUPPORTED_MASK    (NTCREATEX_OPTIONS_OPEN_BY_FILE_ID)
 
+#define NTCREATEX_OPTIONS_INVALID_PARAM_MASK    (NTCREATEX_OPTIONS_OPFILTER | \
+						 NTCREATEX_OPTIONS_SYNC_ALERT | \
+						 NTCREATEX_OPTIONS_ASYNC_ALERT | \
+						 NTCREATEX_OPTIONS_OPFILTER | \
+						 0xFF000000)
 
+/*
+ * We reuse some ignored flags for private use.
+ * This values have different meaning for some ntvfs backends.
+ *
+ * TODO: use values that are ignore for sure...
+ */
+#define NTCREATEX_OPTIONS_PRIVATE_DENY_DOS      0x00010000
+#define NTCREATEX_OPTIONS_PRIVATE_DENY_FCB      0x00020000
+#define NTCREATEX_OPTIONS_PRIVATE_MASK          (NTCREATEX_OPTIONS_PRIVATE_DENY_DOS | \
+						 NTCREATEX_OPTIONS_PRIVATE_DENY_FCB)
 
 /* ntcreatex impersonation field */
 #define NTCREATEX_IMPERSONATION_ANONYMOUS      0
diff --git a/source4/libcli/security/dom_sid.c b/source4/libcli/security/dom_sid.c
index f5457e7e0e..1a7519e362 100644
--- a/source4/libcli/security/dom_sid.c
+++ b/source4/libcli/security/dom_sid.c
@@ -152,6 +152,21 @@ struct dom_sid *dom_sid_parse_talloc(TALLOC_CTX *mem_ctx, const char *sidstr)
 }
 
 /*
+  convert a string to a dom_sid, returning a talloc'd dom_sid
+*/
+struct dom_sid *dom_sid_parse_length(TALLOC_CTX *mem_ctx, const DATA_BLOB *sid)
+{
+	struct dom_sid *ret;
+	char *p = talloc_strndup(mem_ctx, sid->data, sid->length);
+	if (!p) {
+		return NULL;
+	}
+	ret = dom_sid_parse_talloc(mem_ctx, p);
+	talloc_free(p);
+	return ret;
+}
+
+/*
   copy a dom_sid structure
 */
 struct dom_sid *dom_sid_dup(TALLOC_CTX *mem_ctx, const struct dom_sid *dom_sid)
diff --git a/source4/libcli/smb2/connect.c b/source4/libcli/smb2/connect.c
index c89c109b72..43151943d3 100644
--- a/source4/libcli/smb2/connect.c
+++ b/source4/libcli/smb2/connect.c
@@ -115,13 +115,19 @@ static void continue_negprot(struct smb2_request *req)
 		transport->signing_required = false;
 		break;
 	case SMB_SIGNING_SUPPORTED:
-	case SMB_SIGNING_AUTO:
 		if (transport->negotiate.security_mode & SMB2_NEGOTIATE_SIGNING_REQUIRED) {
 			transport->signing_required = true;
 		} else {
 			transport->signing_required = false;
 		}
 		break;
+	case SMB_SIGNING_AUTO:
+		if (transport->negotiate.security_mode & SMB2_NEGOTIATE_SIGNING_ENABLED) {
+			transport->signing_required = true;
+		} else {
+			transport->signing_required = false;
+		}
+		break;
 	case SMB_SIGNING_REQUIRED:
 		if (transport->negotiate.security_mode & SMB2_NEGOTIATE_SIGNING_ENABLED) {
 			transport->signing_required = true;
diff --git a/source4/libcli/smb2/signing.c b/source4/libcli/smb2/signing.c
index 0d655d1a86..de9e1e9d29 100644
--- a/source4/libcli/smb2/signing.c
+++ b/source4/libcli/smb2/signing.c
@@ -94,12 +94,6 @@ NTSTATUS smb2_check_signature(struct smb2_request_buffer *buf, DATA_BLOB session
 		return NT_STATUS_OK;
 	}
 
-	if (session_key.length == 0) {
-		DEBUG(2,("Wrong session key length %u for SMB2 signing\n",
-			 (unsigned)session_key.length));
-		return NT_STATUS_ACCESS_DENIED;
-	}
-
 	memcpy(sig, buf->hdr+SMB2_HDR_SIGNATURE, 16);
 
 	memset(buf->hdr + SMB2_HDR_SIGNATURE, 0, 16);
diff --git a/source4/libcli/smb2/smb2.h b/source4/libcli/smb2/smb2.h
index 5d6341a15b..f00107de60 100644
--- a/source4/libcli/smb2/smb2.h
+++ b/source4/libcli/smb2/smb2.h
@@ -276,7 +276,9 @@ struct smb2_request {
 #define SMB2_CREATE_TAG_TWRP "TWrp"
 #define SMB2_CREATE_TAG_QFID "QFid"
 
-
+/* SMB2 Create ignore some more create_options */
+#define SMB2_CREATE_OPTIONS_NOT_SUPPORTED_MASK	(NTCREATEX_OPTIONS_TREE_CONNECTION | \
+						 NTCREATEX_OPTIONS_OPFILTER)
 
 /*
   check that a body has the expected size
diff --git a/source4/libcli/smb2/transport.c b/source4/libcli/smb2/transport.c
index d9691bec7c..b946a102c8 100644
--- a/source4/libcli/smb2/transport.c
+++ b/source4/libcli/smb2/transport.c
@@ -235,6 +235,17 @@ static NTSTATUS smb2_transport_finish_recv(void *private, DATA_BLOB blob)
 	req->in.body_size = req->in.size - (SMB2_HDR_BODY+NBT_HDR_SIZE);
 	req->status       = NT_STATUS(IVAL(hdr, SMB2_HDR_STATUS));
 
+	if ((flags & SMB2_HDR_FLAG_ASYNC) &&
+	    NT_STATUS_EQUAL(req->status, STATUS_PENDING)) {
+		req->cancel.can_cancel = true;
+		req->cancel.pending_id = IVAL(hdr, SMB2_HDR_PID);
+		for (i=0; i< req->cancel.do_cancel; i++) {
+			smb2_cancel(req);
+		}
+		talloc_free(buffer);
+		return NT_STATUS_OK;
+	}
+
 	if (req->session && req->session->signing_active) {
 		status = smb2_check_signature(&req->in, 
 					      req->session->session_key);
@@ -244,19 +255,6 @@ static NTSTATUS smb2_transport_finish_recv(void *private, DATA_BLOB blob)
 			return status;
 		}
 	}
-	
-
-	if (NT_STATUS_EQUAL(req->status, STATUS_PENDING)) {
-		if (flags & 0x00000002) {
-			req->cancel.can_cancel = true;
-			req->cancel.pending_id = IVAL(hdr, SMB2_HDR_PID);
-			for (i=0; i< req->cancel.do_cancel; i++) {
-				smb2_cancel(req);
-			}
-		}
-		talloc_free(buffer);
-		return NT_STATUS_OK;
-	}
 
 	buffer_code = SVAL(req->in.body, 0);
 	req->in.body_fixed = (buffer_code & ~1);