The branch, v4-8-test has been updated
       via  b368ad2 docs-xml: Add 'samba-tool visualize' to man samba-tool.8.
       via  a9b71ef WHATSNEW: Add section for "samba-tool visualize"
       via  74208be WHATSNEW: Mention new option "apply group policies"
       via  0ae4e26 dbcheck: skip find_missing_forward_links_from_backlinks() 
if the db has the sortedLinks feature
       via  a3a1768 dbcheck: add support for restoring missing forward links
       via  367970e dbcheck: add find_missing_forward_links_from_backlinks()
       via  307ffdc dbcheck: make sure we ask for replPropertyMetaData if we 
need to process any forward link attributes
       via  5f933b9 dbcheck: make sure we always ask for the objectGUID 
attribute explicitly
       via  54b7de0 dbcheck: add a helper function that checks is a value has 
duplicate links
       via  f4cb28b dbcheck: add a dict where we remember attributes with 
duplicate links
       via  8451906 dbcheck: split out check_duplicate_links from check_dn
       via  6564239 dbcheck: store fixed forward link attributes with the 
correct sorting
       via  528cee7 dbcheck: remove ldb.FLAG_MOD_REPLACE when replacing search 
results for forward links
       via  c17794d dbcheck: rename err_duplicate_links() to 
err_recover_forward_links() and adjust the output message
       via  9971ea3 dbcheck: add link direction to error message for duplicate 
links
       via  973b722 dbcheck: rename err_duplicate_links arguments
       via  08dcf2e dbcheck: only pass obj_dn to err_orphaned_backlink()
       via  0e24b58 dbcheck: add forward_syntax argument to 
err_orphaned_backlink
       via  cae3003 dbcheck: rename and reorder err_orphaned_backlink arguments
       via  f4940e6 selftest/dbcheck: add a test for corrupt forward links 
restoration
       via  910d2b2 Revert "dbcheck: disable fixing duplicate linked attributes 
until we can recover lost forward links"
       via  07e3be6 python/common: add __cmp__ function to dsdb_Dn similar to 
parsed_dn_compare()
       via  ba0c378 python:tests: add test_dsdb_Dn_sorted() to 
"samba.tests.common"
       via  b8741f1 python:tests: remove test_dsdb_Dn() to test_dsdb_Dn_binary()
       via  659e390 python:tests: use TestCaseInTempDir for "samba.tests.common"
       via  849a688 WHATSNEW: briefly mention the new vfs_virusfilter module
       via  52109e5 Samba-VirusFilter: fix virusfilter_vfs_close() crash
       via  9511aa8 Samba-VirusFilter: clamav VFS and man page.
       via  36ec386 Samba-VirusFilter: F-Secure AntiVirus (fsav) VFS and man 
page.
       via  326a1e4 Samba-VirusFilter: Sophos VFS backend.
       via  63f9a03 Samba-VirusFilter: common headers and sources.
       via  8f20444 Samba-VirusFilter: memcache changes.
       via  ef18e12 python: fix the build with python3.
       via  7b784df gpo: Correct WHATSNEW
       via  b37223e gpo: Correct documentation
      from  ad481bd VERSION: Bump version up to 4.8.0rc3...

https://git.samba.org/?p=samba.git;a=shortlog;h=v4-8-test


- Log -----------------------------------------------------------------
commit b368ad240da98e5260a05ed4ee304324ced4209e
Author: Karolin Seeger <ksee...@samba.org>
Date:   Mon Feb 5 09:37:48 2018 +0100

    docs-xml: Add 'samba-tool visualize' to man samba-tool.8.
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=13226
    
    Signed-off-by: Karolin Seeger <ksee...@samba.org>
    Reviewed-by: Stefan Metzmacher <me...@samba.org>
    (cherry picked from commit 0109b5965f8a5f467aa12aa505be849ae33e1f8e)
    
    Autobuild-User(v4-8-test): Karolin Seeger <ksee...@samba.org>
    Autobuild-Date(v4-8-test): Fri Feb  9 13:51:35 CET 2018 on sn-devel-144

commit a9b71efb87088771f62b219b8fab3ff79559b0fd
Author: Andrew Bartlett <abart...@samba.org>
Date:   Tue Jan 16 16:23:39 2018 +1300

    WHATSNEW: Add section for "samba-tool visualize"
    
    (text from the commit message by Douglas adding the feature)
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=13226
    
    Signed-off-by: Andrew Bartlett <abart...@samba.org>
    Reviewed-by: Garming Sam <garm...@catalyst.net.nz>
    (cherry picked from commit 83d42203d7d7f7171d44724720fa5cd99590b90b)

commit 74208beb71cbf04e5d9e7092ea1739941e0a5f5b
Author: Andrew Bartlett <abart...@samba.org>
Date:   Tue Jan 16 16:25:38 2018 +1300

    WHATSNEW: Mention new option "apply group policies"
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=13223
    
    Signed-off-by: Andrew Bartlett <abart...@samba.org>
    Reviewed-by: Garming Sam <garm...@catalyst.net.nz>
    
    Autobuild-User(master): Andrew Bartlett <abart...@samba.org>
    Autobuild-Date(master): Thu Feb  1 07:57:54 CET 2018 on sn-devel-144
    
    (cherry picked from commit b3673824adc16a2b26c5fd3c661062d95c3c83eb)

commit 0ae4e26f12a21ae7c0cc297d3d7f865a1726a0b9
Author: Stefan Metzmacher <me...@samba.org>
Date:   Wed Jan 31 09:50:47 2018 +0100

    dbcheck: skip find_missing_forward_links_from_backlinks() if the db has the 
sortedLinks feature
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=13228
    
    Signed-off-by: Stefan Metzmacher <me...@samba.org>
    Reviewed-by: Ralph Boehme <s...@samba.org>
    
    Autobuild-User(master): Stefan Metzmacher <me...@samba.org>
    Autobuild-Date(master): Mon Feb  5 18:32:51 CET 2018 on sn-devel-144
    
    (cherry picked from commit 0c3348feb09f4f0ba85455b8c3ff5c5fa60d139b)

commit a3a17681831fdd7e666d92f95edaf3787a1fb405
Author: Ralph Boehme <s...@samba.org>
Date:   Thu Jan 25 14:48:55 2018 +0100

    dbcheck: add support for restoring missing forward links
    
    This recovers broken databases with duplicate and missing
    forward links.
    
    See commit a25c99c9f1fd1814c56c21848c748cd0e038eed7 for
    the fix that prevents to problem from happening.
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=13228
    
    Pair-Programmed-With: Stefan Metzmacher <me...@samba.org>
    
    Signed-off-by: Ralph Boehme <s...@samba.org>
    Signed-off-by: Stefan Metzmacher <me...@samba.org>
    (cherry picked from commit 5bf823d68bd33ee3160175a18a3838eff4e3cbb2)

commit 367970e43e4c755f9122446b809cb7f0ec7b0541
Author: Ralph Boehme <s...@samba.org>
Date:   Thu Jan 25 14:48:55 2018 +0100

    dbcheck: add find_missing_forward_links_from_backlinks()
    
    find_missing_forward_links_from_backlinks() finds and returns missing 
forward-links by
    searching all for all objects that link to the object in the backlink 
attribute.
    
    This will be used in the next commit to restore forward links in a corrupted
    forward link attribute by passing the missing backling objects to
    err_recover_forward_links().
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=13228
    
    Pair-Programmed-With: Stefan Metzmacher <me...@samba.org>
    
    Signed-off-by: Ralph Boehme <s...@samba.org>
    Signed-off-by: Stefan Metzmacher <me...@samba.org>
    (cherry picked from commit d59f201388e8a16688adda145734dab8e27b785f)

commit 307ffdcb9c16c0cef166d4f2a86b3b97a6ca7480
Author: Stefan Metzmacher <me...@samba.org>
Date:   Tue Jan 30 12:19:31 2018 +0100

    dbcheck: make sure we ask for replPropertyMetaData if we need to process 
any forward link attributes
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=13228
    
    Signed-off-by: Stefan Metzmacher <me...@samba.org>
    Reviewed-by: Ralph Boehme <s...@samba.org>
    (cherry picked from commit 182fb3c4c9db8715d0dbcbc3d1aa0655b5cb29f1)

commit 5f933b99bda3e266f96da3b73e70a9d6966e6ba7
Author: Stefan Metzmacher <me...@samba.org>
Date:   Tue Jan 30 12:19:31 2018 +0100

    dbcheck: make sure we always ask for the objectGUID attribute explicitly
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=13228
    
    Signed-off-by: Stefan Metzmacher <me...@samba.org>
    Reviewed-by: Ralph Boehme <s...@samba.org>
    (cherry picked from commit 20598033866ca3d0fdad1edf3cb39e4614eae112)

commit 54b7de0c0827b31476591105ac3150e983c86ae4
Author: Ralph Boehme <s...@samba.org>
Date:   Wed Jan 24 22:24:15 2018 +0100

    dbcheck: add a helper function that checks is a value has duplicate links
    
    Will be used in a subsequent commit.
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=13228
    
    Pair-Programmed-With: Stefan Metzmacher <me...@samba.org>
    
    Signed-off-by: Ralph Boehme <s...@samba.org>
    Signed-off-by: Stefan Metzmacher <me...@samba.org>
    (cherry picked from commit e258b4fb281d8577c425e05b35ce05cf128617ea)

commit f4cb28b18e1a2c39101554570451dfb0614cd5db
Author: Ralph Boehme <s...@samba.org>
Date:   Thu Jan 25 10:34:29 2018 +0100

    dbcheck: add a dict where we remember attributes with duplicate links
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=13228
    
    Pair-Programmed-With: Stefan Metzmacher <me...@samba.org>
    
    Signed-off-by: Ralph Boehme <s...@samba.org>
    Signed-off-by: Stefan Metzmacher <me...@samba.org>
    (cherry picked from commit e4cc062fa98f65369f3bde24a987c2651632cb06)

commit 84519065f0a1f45b5e69c7fa06ade389d8ce32a9
Author: Ralph Boehme <s...@samba.org>
Date:   Wed Jan 24 20:01:27 2018 +0100

    dbcheck: split out check_duplicate_links from check_dn
    
    Refactoring, no change in behaviour.
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=13228
    
    Pair-Programmed-With: Stefan Metzmacher <me...@samba.org>
    
    Signed-off-by: Ralph Boehme <s...@samba.org>
    Signed-off-by: Stefan Metzmacher <me...@samba.org>
    (cherry picked from commit 44a8782d71676517f0991f279f2472391ecede3b)

commit 65642396e956bfd03696106f3ea2bdf1372c7c18
Author: Stefan Metzmacher <me...@samba.org>
Date:   Tue Jan 30 09:55:21 2018 +0100

    dbcheck: store fixed forward link attributes with the correct sorting
    
    The corruption we're trying to fix messed up the sorting,
    so there's no point in keeping the current order.
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=13228
    
    Signed-off-by: Stefan Metzmacher <me...@samba.org>
    Reviewed-by: Ralph Boehme <s...@samba.org>
    (cherry picked from commit 7df17c0a8dffceb053ca806c9426d493b4837b1a)

commit 528cee7a3c27c1fc5d4918d87e2f58d4958b08dd
Author: Stefan Metzmacher <me...@samba.org>
Date:   Tue Jan 30 09:39:40 2018 +0100

    dbcheck: remove ldb.FLAG_MOD_REPLACE when replacing search results for 
forward links
    
    Search results don't have an ldb.FLAG_MOD_* flags set.
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=13228
    
    Signed-off-by: Stefan Metzmacher <me...@samba.org>
    Reviewed-by: Ralph Boehme <s...@samba.org>
    (cherry picked from commit b0bc3f60084e5998dd34aada2ac7377d390affc6)

commit c17794d5c7a6080c6a41ddd38cc59a7f5c94f7dc
Author: Ralph Boehme <s...@samba.org>
Date:   Thu Jan 25 14:36:52 2018 +0100

    dbcheck: rename err_duplicate_links() to err_recover_forward_links() and 
adjust the output message
    
    It's really a fatal error to have duplicate values as it's very likely that
    some forward links got lost.
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=13228
    
    Pair-Programmed-With: Stefan Metzmacher <me...@samba.org>
    
    Signed-off-by: Ralph Boehme <s...@samba.org>
    Signed-off-by: Stefan Metzmacher <me...@samba.org>
    (cherry picked from commit ec433f8531a822dd40b343fbf3244157a5ecd544)

commit 9971ea32e27775c36d5a87e9ab92b5c619d91818
Author: Ralph Boehme <s...@samba.org>
Date:   Thu Jan 25 14:41:58 2018 +0100

    dbcheck: add link direction to error message for duplicate links
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=13228
    
    Pair-Programmed-With: Stefan Metzmacher <me...@samba.org>
    
    Signed-off-by: Ralph Boehme <s...@samba.org>
    Signed-off-by: Stefan Metzmacher <me...@samba.org>
    (cherry picked from commit dc43d31cd20fd12d2758b73ec0318215b8fbedfb)

commit 973b72286b052ad32d288613d19f0c819a69ce82
Author: Ralph Boehme <s...@samba.org>
Date:   Wed Jan 24 19:37:55 2018 +0100

    dbcheck: rename err_duplicate_links arguments
    
    In preperation of adding more arguments.
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=13228
    
    Pair-Programmed-With: Stefan Metzmacher <me...@samba.org>
    
    Signed-off-by: Ralph Boehme <s...@samba.org>
    Reviewed-by: Stefan Metzmacher <me...@samba.org>
    (cherry picked from commit a651cc79d64b9bcc1d5fee9b2ef8800a1579dea1)

commit 08dcf2e4b847627ed98165d14ce4457512fd3c22
Author: Stefan Metzmacher <me...@samba.org>
Date:   Mon Jan 29 22:48:42 2018 +0100

    dbcheck: only pass obj_dn to err_orphaned_backlink()
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=13228
    
    Signed-off-by: Stefan Metzmacher <me...@samba.org>
    Reviewed-by: Ralph Boehme <s...@samba.org>
    (cherry picked from commit 9f47fe6c4a8bde4abfee3c774d9667e6a3439a45)

commit 0e24b58d1e00b1321dd7fc01dded4a5e15174065
Author: Ralph Boehme <s...@samba.org>
Date:   Thu Jan 25 10:52:35 2018 +0100

    dbcheck: add forward_syntax argument to err_orphaned_backlink
    
    Will be used in a subsequent commit.
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=13228
    
    Pair-Programmed-With: Stefan Metzmacher <me...@samba.org>
    
    Signed-off-by: Ralph Boehme <s...@samba.org>
    Signed-off-by: Stefan Metzmacher <me...@samba.org>
    (cherry picked from commit 6f77503871fcb815e474cb76d14e22f7a8f083c9)

commit cae3003fc451958e214a4bd445cbbaab268c6b02
Author: Ralph Boehme <s...@samba.org>
Date:   Wed Jan 24 19:31:23 2018 +0100

    dbcheck: rename and reorder err_orphaned_backlink arguments
    
    In preperation of adding more arguments.
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=13228
    
    Pair-Programmed-With: Stefan Metzmacher <me...@samba.org>
    
    Signed-off-by: Ralph Boehme <s...@samba.org>
    Signed-off-by: Stefan Metzmacher <me...@samba.org>
    (cherry picked from commit 4a71394c6a30e8a1b5c6553f7410148dbf2e4a80)

commit f4940e695586bfb8ddfd266e51bf131e0a4f56e5
Author: Ralph Boehme <s...@samba.org>
Date:   Thu Jan 25 21:34:47 2018 +0100

    selftest/dbcheck: add a test for corrupt forward links restoration
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=13228
    
    Signed-off-by: Ralph Boehme <s...@samba.org>
    Reviewed-by: Stefan Metzmacher <me...@samba.org>
    (cherry picked from commit 52bd0b09804621e6de9ee0a377a442a42e07ee05)

commit 910d2b240fbea5776eb93b486847ce4fb7c20a4b
Author: Ralph Boehme <s...@samba.org>
Date:   Wed Jan 24 11:34:43 2018 +0100

    Revert "dbcheck: disable fixing duplicate linked attributes until we can 
recover lost forward links"
    
    This reverts commit 43e3f79d54c5aeaea820865d298d4249cf47af99.
    
    The real fix will follow in the next commits.
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=13228
    
    Signed-off-by: Ralph Boehme <s...@samba.org>
    Signed-off-by: Stefan Metzmacher <me...@samba.org>
    (cherry picked from commit 8c01acd56274a5cb5926622cacab997cb62dd5a9)

commit 07e3be672bb77f3b9ee79fa01c230fdbf480d28d
Author: Stefan Metzmacher <me...@samba.org>
Date:   Tue Jan 30 09:51:20 2018 +0100

    python/common: add __cmp__ function to dsdb_Dn similar to 
parsed_dn_compare()
    
    Linked attribute values are sorted by objectGUID of the link target.
    For C code we have parsed_dn_compare() to implement the logic,
    the same is now available on python dsdb_Dn objects.
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=13228
    
    Signed-off-by: Stefan Metzmacher <me...@samba.org>
    Reviewed-by: Ralph Boehme <s...@samba.org>
    (cherry picked from commit 55d466549a3113f7625acdd6eb42f71cf63719b5)

commit ba0c3781bdc33a539870af178b9e4d24c8d36044
Author: Stefan Metzmacher <me...@samba.org>
Date:   Tue Jan 30 11:09:55 2018 +0100

    python:tests: add test_dsdb_Dn_sorted() to "samba.tests.common"
    
    Failing until dsdb_Dn implements the correct __cmp__() function.
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=13228
    
    Signed-off-by: Stefan Metzmacher <me...@samba.org>
    Reviewed-by: Ralph Boehme <s...@samba.org>
    (cherry picked from commit c56eb49119117a1a06afb0a76630ae5c7a1ca30c)

commit b8741f18c3160810301da435b217e030436c2b1b
Author: Stefan Metzmacher <me...@samba.org>
Date:   Tue Jan 30 11:09:40 2018 +0100

    python:tests: remove test_dsdb_Dn() to test_dsdb_Dn_binary()
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=13228
    
    Signed-off-by: Stefan Metzmacher <me...@samba.org>
    Reviewed-by: Ralph Boehme <s...@samba.org>
    (cherry picked from commit 1341780dcf9ec0c5d852fbbb77c5e00db2ad6564)

commit 659e39009ce281bf67dba522df9e771e8e8e98fe
Author: Stefan Metzmacher <me...@samba.org>
Date:   Tue Jan 30 10:39:30 2018 +0100

    python:tests: use TestCaseInTempDir for "samba.tests.common"
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=13228
    
    Signed-off-by: Stefan Metzmacher <me...@samba.org>
    Reviewed-by: Ralph Boehme <s...@samba.org>
    (cherry picked from commit 681e0a1745b45c6ac22d394b9e78cb67007d7dc4)

commit 849a688062241b50f5cde5af6ead7c3516e9a716
Author: David Disseldorp <dd...@samba.org>
Date:   Wed Jan 24 16:19:51 2018 +0100

    WHATSNEW: briefly mention the new vfs_virusfilter module
    
    Signed-off-by: David Disseldorp <dd...@samba.org>

commit 52109e5033fdc5fea49c7490c7e1a21b2a2fd360
Author: Trever L. Adams <trever.ad...@gmail.com>
Date:   Wed Jan 24 10:42:11 2018 -0700

    Samba-VirusFilter: fix virusfilter_vfs_close() crash
    
    Bug: https://bugzilla.samba.org/show_bug.cgi?id=13246
    
    Signed-off-by: Trever L. Adams <trever.ad...@gmail.com>
    Reviewed-by: Jeremy Allison <j...@samba.org>
    Reviewed-by: David Disseldorp <dd...@samba.org>
    (cherry picked from commit c890011a769b497855748e130fa41e998babc305)

commit 9511aa8ae8fe3528801d75b2cf5fbad043cf74ca
Author: Trever L. Adams <trever.ad...@gmail.com>
Date:   Tue Oct 18 13:40:01 2016 -0600

    Samba-VirusFilter: clamav VFS and man page.
    
    Bug: https://bugzilla.samba.org/show_bug.cgi?id=13246
    
    Signed-off-by: Trever L. Adams <trever.ad...@gmail.com>
    Signed-off-by: SATOH Fumiyasu <fumi...@osstech.co.jp>
    Reviewed-by: Jeremy Allison <j...@samba.org>
    Reviewed-by: Ralph Boehme <s...@samba.org>
    
    Autobuild-User(master): Ralph Böhme <s...@samba.org>
    Autobuild-Date(master): Wed Jan 24 15:08:59 CET 2018 on sn-devel-144
    
    (cherry picked from commit cbf743d329730387ede92a9d329893d1c651e97a)

commit 36ec386b8f6c4fc6d14290d6bc3d25ca16d867c3
Author: Trever L. Adams <trever.ad...@gmail.com>
Date:   Tue Oct 18 13:39:20 2016 -0600

    Samba-VirusFilter: F-Secure AntiVirus (fsav) VFS and man page.
    
    Bug: https://bugzilla.samba.org/show_bug.cgi?id=13246
    
    Signed-off-by: Trever L. Adams <trever.ad...@gmail.com>
    Signed-off-by: SATOH Fumiyasu <fumi...@osstech.co.jp>
    Reviewed-by: Jeremy Allison <j...@samba.org>
    Reviewed-by: Ralph Boehme <s...@samba.org>
    (cherry picked from commit 5970d68bf651fb8dbf1ac4e79d8f2e9467154870)

commit 326a1e4eba23152f76b3258acff3b2d4a55f2cc2
Author: Trever L. Adams <trever.ad...@gmail.com>
Date:   Tue Oct 18 13:38:14 2016 -0600

    Samba-VirusFilter: Sophos VFS backend.
    
    Bug: https://bugzilla.samba.org/show_bug.cgi?id=13246
    
    Signed-off-by: Trever L. Adams <trever.ad...@gmail.com>
    Signed-off-by: SATOH Fumiyasu <fumi...@osstech.co.jp>
    Reviewed-by: Jeremy Allison <j...@samba.org>
    Reviewed-by: Ralph Boehme <s...@samba.org>
    (cherry picked from commit 0b25089edd453270e52f2d8e6858a9996bb29a0d)

commit 63f9a037fd3ccf54873e5b25772fe6cc5c2ed6cd
Author: Trever L. Adams <trever.ad...@gmail.com>
Date:   Tue Oct 18 13:34:53 2016 -0600

    Samba-VirusFilter: common headers and sources.
    
    Samba-VirusFilter Contributors:
    
    SATOH Fumiyasu @ OSS Technology Corp., Japan
    Module creator/maintainer
    
    Luke Dixon luke.di...@zynstra.com
    Samba 4 support
    
    Trever L. Adams
    Documentation
    Code contributions
    Samba-master merge work
    
    With many thanks to the Samba Team.
    
    Bug: https://bugzilla.samba.org/show_bug.cgi?id=13246
    
    Signed-off-by: Trever L. Adams <trever.ad...@gmail.com>
    Signed-off-by: SATOH Fumiyasu <fumi...@osstech.co.jp>
    Reviewed-by: Jeremy Allison <j...@samba.org>
    Reviewed-by: Ralph Boehme <s...@samba.org>
    (cherry picked from commit b1e69edd0592d3b4b0f958792826a236dd3466e1)

commit 8f20444abe0d476e90be011a1cc5d0275e87069a
Author: Trever L. Adams <trever.ad...@gmail.com>
Date:   Tue Oct 18 13:37:19 2016 -0600

    Samba-VirusFilter: memcache changes.
    
    Bug: https://bugzilla.samba.org/show_bug.cgi?id=13246
    
    Signed-off-by: Trever L. Adams <trever.ad...@gmail.com>
    Reviewed-by: Jeremy Allison <j...@samba.org>
    Reviewed-by: Ralph Boehme <s...@samba.org>
    (cherry picked from commit 70d7f7d03c46c8727833f322bdc03da1b2aad720)

commit ef18e12cfcd34f8c8097a70c2993405a6c186ac9
Author: Günther Deschner <g...@samba.org>
Date:   Mon Jan 15 21:56:22 2018 +0100

    python: fix the build with python3.
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=13221
    
    Guenther
    
    Signed-off-by: Guenther Deschner <g...@samba.org>
    Reviewed-by: Alexander Bokovoy <a...@samba.org>

commit 7b784dfb532efc5bded3d9d26e978fc7387f81a6
Author: David Mulder <dmul...@suse.com>
Date:   Mon Jan 15 08:20:08 2018 -0700

    gpo: Correct WHATSNEW
    
    The WHATSNEW incorrectly explains how to enable gpo.
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=13223
    
    Signed-off-by: David Mulder <dmul...@suse.com>
    Reviewed-by: Andrew Bartlett <abart...@samba.org>
    Reviewed-by: Andreas Schneider <a...@samba.org>

commit b37223ece44cd3364e78e1aa5f764ecc6e7b3387
Author: David Mulder <dmul...@suse.com>
Date:   Mon Jan 15 11:37:47 2018 -0700

    gpo: Correct documentation
    
    The doc still contains a reference to env var
    policy (which isn't present in this release).
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=13223
    
    Signed-off-by: David Mulder <dmul...@suse.com>
    Reviewed-by: Andrew Bartlett <abart...@samba.org>
    Reviewed-by: Andreas Schneider <a...@samba.org>

-----------------------------------------------------------------------

Summary of changes:
 WHATSNEW.txt                                       |   32 +-
 docs-xml/manpages/samba-tool.8.xml                 |   57 +-
 docs-xml/manpages/vfs_virusfilter.8.xml            |  369 +++++
 docs-xml/smbdotconf/domain/gpoupdatecommand.xml    |    9 +-
 docs-xml/wscript_build                             |    1 +
 .../scripts/vfs/virusfilter/virusfilter-notify.ksh |  284 ++++
 lib/util/memcache.c                                |    1 +
 lib/util/memcache.h                                |    3 +-
 python/samba/common.py                             |   17 +
 python/samba/dbchecker.py                          |  332 ++++-
 python/samba/emulate/traffic_packets.py            |    2 +-
 python/samba/forest_update.py                      |    4 +-
 python/samba/tests/blackbox/traffic_summary.py     |    2 +-
 python/samba/tests/common.py                       |   33 +-
 python/samba/tests/samba_tool/visualize.py         |    6 +-
 selftest/knownfail.d/dbcheck_duplicate_member      |    5 -
 source3/modules/vfs_virusfilter.c                  | 1521 ++++++++++++++++++++
 source3/modules/vfs_virusfilter_clamav.c           |  195 +++
 source3/modules/vfs_virusfilter_common.h           |  153 ++
 source3/modules/vfs_virusfilter_fsav.c             |  451 ++++++
 source3/modules/vfs_virusfilter_sophos.c           |  391 +++++
 source3/modules/vfs_virusfilter_utils.c            | 1025 +++++++++++++
 source3/modules/vfs_virusfilter_utils.h            |  177 +++
 source3/modules/wscript_build                      |   18 +
 source3/wscript                                    |    2 +-
 ...ted-after-dbcheck-forward-link-corruption.ldif} |    8 +-
 ...dbcheck-link-output-forward-link-corruption.txt |   12 +
 ...pected-dbcheck-link-output_duplicate_member.txt |    5 +-
 testprogs/blackbox/dbcheck-links.sh                |   78 +
 29 files changed, 5093 insertions(+), 100 deletions(-)
 create mode 100644 docs-xml/manpages/vfs_virusfilter.8.xml
 create mode 100644 examples/scripts/vfs/virusfilter/virusfilter-notify.ksh
 delete mode 100644 selftest/knownfail.d/dbcheck_duplicate_member
 create mode 100644 source3/modules/vfs_virusfilter.c
 create mode 100644 source3/modules/vfs_virusfilter_clamav.c
 create mode 100644 source3/modules/vfs_virusfilter_common.h
 create mode 100644 source3/modules/vfs_virusfilter_fsav.c
 create mode 100644 source3/modules/vfs_virusfilter_sophos.c
 create mode 100644 source3/modules/vfs_virusfilter_utils.c
 create mode 100644 source3/modules/vfs_virusfilter_utils.h
 copy 
source4/selftest/provisions/release-4-5-0-pre1/{expected-duplicates-after-link-dbcheck.ldif
 => expected-after-dbcheck-forward-link-corruption.ldif} (65%)
 create mode 100644 
source4/selftest/provisions/release-4-5-0-pre1/expected-dbcheck-link-output-forward-link-corruption.txt


Changeset truncated at 500 lines:

diff --git a/WHATSNEW.txt b/WHATSNEW.txt
index 9365008..3a923b1 100644
--- a/WHATSNEW.txt
+++ b/WHATSNEW.txt
@@ -27,7 +27,7 @@ renew lifetime).
 Adds the samba_gpoupdate script for applying and unapplying
 policy. Can be applied automatically by setting
 
- 'server services = +gpoupdate'.
+ 'apply group policies = yes'.
 
 Time Machine Support with vfs_fruit
 -----------------------------------
@@ -88,6 +88,29 @@ The key file "encrypted_secrets.key" is created in the same 
directory
 as the database and should NEVER be disclosed.  It is included by the
 samba_backup script.
 
+Active Directory replication visualisation
+------------------------------------------
+
+To work out what is happening in a replication graph, it is sometimes
+helpful to use visualisations. We introduce a samba-tool subcommand to
+write Graphviz dot output and generate text-based heatmaps of the
+distance in hops between DCs.
+
+There are two subcommands, two graphical modes, and (roughly) two modes of
+operation with respect to the location of authority.
+
+`samba-tool visualize ntdsconn` looks at NTDS Connections.
+`samba-tool visualize reps` looks at repsTo and repsFrom objects.
+
+In '--distance' mode (default), the distances between DCs are shown in
+a matrix in the terminal. With '--color=yes', this is depicted as a
+heatmap. With '--utf8' it is a lttle prettier.
+
+In '--dot' mode, Graphviz dot output is generated. When viewed using
+dot or xdot, this shows the network as a graph with DCs as vertices
+and connections edges. Certain types of degenerate edges are shown in
+different colours or line-styles.
+
 NT4-style replication based net commands removed
 ------------------------------------------------
 
@@ -147,6 +170,12 @@ domains. Some pam_winbind setups may also require the 
global list.
 If you have a setup that doesn't require the global list, you should set
 "winbind scan trusted domains = no".
 
+VirusFilter VFS module
+----------------------
+
+This new module integrates with Sophos, F-Secure and ClamAV anti-virus
+software to provide scanning and filtering of files on a Samba share.
+
 
 REMOVED FEATURES
 ================
@@ -171,6 +200,7 @@ smb.conf changes
 
   Parameter Name                     Description             Default
   --------------                     -----------             -------
+  apply group policies               New                     no
   auth methods                       Removed
   binddns dir                        New
   client schannel                    Default changed/        yes
diff --git a/docs-xml/manpages/samba-tool.8.xml 
b/docs-xml/manpages/samba-tool.8.xml
index ed10d61..1349654 100644
--- a/docs-xml/manpages/samba-tool.8.xml
+++ b/docs-xml/manpages/samba-tool.8.xml
@@ -607,6 +607,61 @@
 </refsect2>
 
 <refsect2>
+       <title>visualize [options] <replaceable>subcommand</replaceable></title>
+       <para>Produce graphical representations of Samba network state.
+       To work out what is happening in a replication graph, it is sometimes
+       helpful to use visualisations.</para>
+
+       <para>
+       There are two subcommands, two graphical modes, and (roughly) two modes
+       of operation with respect to the location of authority.</para>
+
+       <refsect3><title>MODES OF OPERATION</title>
+       <varlistentry>
+                <term>samba-tool visualize ntdsconn</term>
+                <listitem><para>Looks at NTDS connections.
+                </para></listitem>
+                </varlistentry>
+
+       <varlistentry>
+               <term>samba-tool visualize reps</term>
+               <listitem><para>Looks at repsTo and repsFrom objects.
+               </para></listitem>
+               </varlistentry>
+       </refsect3>
+
+       <refsect3><title>GRAPHICAL MODES</title>
+       <varlistentry>
+                <term>--distance</term>
+                <listitem><para>Distances between DCs are shown in a matrix in
+                the terminal.
+                </para></listitem>
+                </varlistentry>
+
+       <varlistentry>
+                <term>--dot</term>
+                <listitem><para>Generate Graphviz dot output. When viewed using
+               dot or xdot, this shows the network as a graph with DCs as
+               vertices and connections edges. Certain types of degenerate
+               edges are shown in different colours or line-styles.
+                </para></listitem>
+                </varlistentry>
+       </refsect3>
+
+       <varlistentry>
+               <term>-r</term>
+               <listitem><para>Normally, <command>samba-tool</command> talks
+               to one database; with the <arg choice="opt">-r</arg> option
+               attempts are made to contact all the DCs known to the first
+               database. This is necessary to get sensible results from
+               <command>samba-tool visualize reps</command> because the
+               repsFrom/To objects are not replicated, and it can reveal
+               replication issues in other modes.
+                </para></listitem>
+                </varlistentry>
+</refsect2>
+
+<refsect2>
 <title>help</title>
 <para>Gives usage information.</para>
 </refsect2>
@@ -627,8 +682,6 @@
        were created by Andrew Tridgell. Samba is now developed
        by the Samba Team as an Open Source project similar
        to the way the Linux kernel is developed.</para>
-
-       <para>The samba-tool manpage was written by Karolin Seeger.</para>
 </refsect1>
 
 </refentry>
diff --git a/docs-xml/manpages/vfs_virusfilter.8.xml 
b/docs-xml/manpages/vfs_virusfilter.8.xml
new file mode 100644
index 0000000..ee49df1
--- /dev/null
+++ b/docs-xml/manpages/vfs_virusfilter.8.xml
@@ -0,0 +1,369 @@
+<?xml version="1.0" encoding="iso-8859-1"?>
+<!DOCTYPE refentry PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant 
V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc";>
+<refentry id="vfs_virusfilter.8">
+
+<refmeta>
+       <refentrytitle>vfs_virusfilter</refentrytitle>
+       <manvolnum>8</manvolnum>
+       <refmiscinfo class="source">Samba</refmiscinfo>
+       <refmiscinfo class="manual">System Administration tools</refmiscinfo>
+       <refmiscinfo class="version">4.8</refmiscinfo>
+</refmeta>
+
+
+<refnamediv>
+       <refname>vfs_virusfilter</refname>
+       <refpurpose>On access virus scanner</refpurpose>
+</refnamediv>
+
+<refsynopsisdiv>
+       <cmdsynopsis>
+               <command>vfs objects = virusfilter</command>
+       </cmdsynopsis>
+</refsynopsisdiv>
+
+<refsect1>
+       <title>DESCRIPTION</title>
+
+       <para>This is a set of various Samba VFS modules to scan and filter
+       virus files on Samba file services with an anti-virus scanner.</para>
+
+       <para>This module is stackable.</para>
+
+</refsect1>
+
+<refsect1>
+       <title>OPTIONS</title>
+
+       <variablelist>
+
+               <varlistentry>
+               <term>virusfilter:scanner</term>
+               <listitem>
+               <para>The antivirus scan-engine.</para>
+               <itemizedlist>
+                 <listitem><para><emphasis>sophos</emphasis>, the Sophos AV
+                 scanner</para></listitem>
+                 <listitem><para><emphasis>fsav</emphasis>, the F-Secure AV
+                 scanner</para></listitem>
+                 <listitem><para><emphasis>clamav</emphasis>, the ClamAV
+                 scanner</para></listitem>
+               </itemizedlist>
+               </listitem>
+               </varlistentry>
+
+               <varlistentry>
+               <term>virusfilter:socket path = PATH</term>
+               <listitem>
+               <para>Path of local socket for the virus scanner.
+               </para>
+               <para>If this option is not set, the default path depends on the
+               configured AV scanning engine.
+               </para>
+               <para>For the <emphasis>sophos</emphasis>backend the default is
+               <emphasis>/var/run/savdi/sssp.sock</emphasis>.</para>
+               <para>For the <emphasis>fsav</emphasis> backend the default is
+               <emphasis>/tmp/.fsav-0</emphasis>.</para>
+               <para>For the <emphasis>fsav</emphasis> backend the default is
+               <emphasis>/var/run/clamav/clamd.ctl</emphasis>.</para>
+               </listitem>
+               </varlistentry>
+
+               <varlistentry>
+               <term>virusfilter:connect timeout = 30000</term>
+               <listitem>
+               <para>Controls how long to wait on connecting to the virus
+               scanning process before timing out. Value is in milliseconds.
+               </para>
+               <para>If this option is not set, the default is 30000.</para>
+               </listitem>
+               </varlistentry>
+
+               <varlistentry>
+               <term>virusfilter:io timeout = 60000</term>
+               <listitem>
+               <para>Controls how long to wait on communications with the virus
+               scanning process before timing out. Value is in milliseconds.
+               </para>
+               <para>If this option is not set, the default is 60000.</para>
+               </listitem>
+               </varlistentry>
+
+               <varlistentry>
+               <term>virusfilter:scan on open = yes</term>
+               <listitem>
+               <para>This option controls whether files are scanned on open.
+               </para>
+               <para>If this option is not set, the default is yes.</para>
+               </listitem>
+               </varlistentry>
+
+               <varlistentry>
+               <term>virusfilter:scan on close = no</term>
+               <listitem>
+               <para>This option controls whether files are scanned on close.
+               </para>
+               <para>If this option is not set, the default is no.</para>
+               </listitem>
+               </varlistentry>
+
+               <varlistentry>
+               <term>virusfilter:max file size = 100000000</term>
+               <listitem>
+               <para>This is the largest sized file, in bytes, which will be 
scanned.
+               </para>
+               <para>If this option is not set, the default is 100MB.</para>
+               </listitem>
+               </varlistentry>
+
+               <varlistentry>
+               <term>virusfilter:min file size = 10</term>
+               <listitem>
+               <para>This is the smallest sized file, in bytes, which will be 
scanned.
+               </para>
+               <para>If this option is not set, the default is 10.</para>
+               </listitem>
+               </varlistentry>
+
+               <varlistentry>
+               <term>virusfilter:infected file action = nothing</term>
+               <listitem>
+               <para>What to do with an infected file. The options are
+               nothing, quarantine, rename, delete.</para>
+               <para>If this option is not set, the default is nothing.</para>
+               </listitem>
+               </varlistentry>
+
+               <varlistentry>
+               <term>virusfilter:infected file errno on open = EACCES</term>
+               <listitem>
+               <para>What errno to return on open if the file is infected.
+               </para>
+               <para>If this option is not set, the default is EACCES.</para>
+               </listitem>
+               </varlistentry>
+
+               <varlistentry>
+               <term>virusfilter:infected file errno on close = 0</term>
+               <listitem>
+               <para>What errno to return on close if the file is infected.
+               </para>
+               <para>If this option is not set, the default is 0.</para>
+               </listitem>
+               </varlistentry>
+
+               <varlistentry>
+               <term>virusfilter:quarantine directory = PATH</term>
+               <listitem>
+               <para>Where to move infected files. This path must be an
+               absolute path.</para>
+               <para>If this option is not set, the default is ".quarantine"
+               relative to the share path. </para>
+               </listitem>
+               </varlistentry>
+
+               <varlistentry>
+               <term>virusfilter:quarantine prefix = virusfilter.</term>
+               <listitem>
+               <para>Prefix for quarantined files.</para>
+               <para>If this option is not set, the default is 
"virusfilter.".</para>
+               </listitem>
+               </varlistentry>
+
+               <varlistentry>
+               <term>virusfilter:quarantine suffix = .infected</term>
+               <listitem>
+               <para>Suffix for quarantined files.
+               This option is only used if keep name is true. Otherwise it is 
ignored.</para>
+               <para>If this option is not set, the default is 
".infected".</para>
+               </listitem>
+               </varlistentry>
+
+               <varlistentry>
+               <term>virusfilter:rename prefix = virusfilter.</term>
+               <listitem>
+               <para>Prefix for infected files.</para>
+               <para>If this option is not set, the default is 
"virusfilter.".</para>
+               </listitem>
+               </varlistentry>
+
+               <varlistentry>
+               <term>virusfilter:rename suffix = .infected</term>
+               <listitem>
+               <para>Suffix for infected files.</para>
+               <para>If this option is not set, the default is 
".infected".</para>
+               </listitem>
+               </varlistentry>
+
+               <varlistentry>
+               <term>virusfilter:quarantine keep tree = yes</term>
+               <listitem>
+               <para>If keep tree is set, the directory structure relative
+               to the share is maintained in the quarantine directory.
+               </para>
+               <para>If this option is not set, the default is yes.</para>
+               </listitem>
+               </varlistentry>
+
+               <varlistentry>
+               <term>virusfilter:quarantine keep name = yes</term>
+               <listitem>
+               <para>Should the file name be left unmodified other than adding 
a suffix
+               and/or prefix and a random suffix name as defined in 
virusfilter:rename prefix
+               and virusfilter:rename suffix.</para>
+               <para>If this option is not set, the default is yes.</para>
+               </listitem>
+               </varlistentry>
+
+               <varlistentry>
+               <term>virusfilter:infected file command = 
@SAMBA_DATADIR@/bin/virusfilter-notify --mail-to virusmas...@example.com --cc 
"%u...@example.com" --from sa...@example.com --subject-prefix "Samba: Infected 
File: "</term>
+               <listitem>
+               <para>External command to run on an infected file is 
found.</para>
+               <para>If this option is not set, the default is none.</para>
+               </listitem>
+               </varlistentry>
+
+               <varlistentry>
+               <term>virusfilter:scan archive = true</term>
+               <listitem>
+               <para>This defines whether or not to scan archives.</para>
+               <para>Sophos and F-Secure support this and it defaults to 
false.</para>
+               </listitem>
+               </varlistentry>
+
+               <varlistentry>
+               <term>virusfilter:max nested scan archive = 1</term>
+               <listitem>
+               <para>This defines the maximum depth to search nested 
archives.</para>
+               <para>The Sophos and F-Secure support this and it defaults to 
1.</para>
+               </listitem>
+               </varlistentry>
+
+               <varlistentry>
+               <term>virusfilter:scan mime = true</term>
+               <listitem>
+               <para>This defines whether or not to scan mime files.</para>
+               <para>Only the <emphasis>fsav</emphasis>scanner supports this
+               option and defaults to false.</para>
+               </listitem>
+               </varlistentry>
+
+               <varlistentry>
+               <term>virusfilter:scan error command = 
@SAMBA_DATADIR@/bin/virusfilter-notify --mail-to virusmas...@example.com --from 
sa...@example.com --subject-prefix "Samba: Scan Error: "</term>
+               <listitem>
+               <para>External command to run on scan error.</para>
+               <para>If this option is not set, the default is none.</para>
+               </listitem>
+               </varlistentry>
+
+               <varlistentry>
+               <term>virusfilter:exclude files = empty</term>
+               <listitem>
+               <para>Files to exclude from scanning.</para>
+               <para>If this option is not set, the default is empty.</para>
+               </listitem>
+               </varlistentry>
+
+               <varlistentry>
+               <term>virusfilter:block access on error = false</term>
+               <listitem>
+               <para>Controls whether or not access should be blocked on
+               a scanning error.</para>
+               <para>If this option is not set, the default is false.</para>
+               </listitem>
+               </varlistentry>
+
+               <varlistentry>
+               <term>virusfilter:scan error errno on open = EACCES</term>
+               <listitem>
+               <para>What errno to return on open if there is an error in
+               scanning the file and block access on error is true.
+               </para>
+               <para>If this option is not set, the default is EACCES.</para>
+               </listitem>
+               </varlistentry>
+
+               <varlistentry>
+               <term>virusfilter:scan error errno on close = 0</term>
+               <listitem>
+               <para>What errno to return on close if there is an error in
+               scanning the file and block access on error is true.
+               </para>
+               <para>If this option is not set, the default is 0.</para>
+               </listitem>
+               </varlistentry>
+
+               <varlistentry>
+               <term>virusfilter:cache entry limit = 100</term>
+               <listitem>
+               <para>The maximum number of entries in the scanning results
+               cache. Due to how Samba's memcache works, this is 
approximate.</para>
+               <para>If this option is not set, the default is 100.</para>
+               </listitem>
+               </varlistentry>
+
+               <varlistentry>
+               <term>virusfilter:cache time limit = 10</term>
+               <listitem>
+               <para>The maximum number of seconds that a scanning result
+               will stay in the results cache. -1 disables the limit.
+               0 disables caching.</para>
+               <para>If this option is not set, the default is 10.</para>
+               </listitem>
+               </varlistentry>
+
+               <varlistentry>
+               <term>virusfilter:quarantine directory mode = 0755</term>
+               <listitem>
+               <para>This is the octet mode for the quarantine directory and
+               its sub-directories as they are created.</para>
+               <para>If this option is not set, the default is 0755 or
+               S_IRUSR | S_IWUSR | S_IXUSR | S_IRGRP | S_IXGRP | S_IROTH |
+               S_IXOTH.</para>
+               <para>Permissions must be such that all users can read and
+               search. I.E. don't mess with this unless you really know what
+               you are doing.</para>
+               </listitem>
+               </varlistentry>
+
+               <varlistentry>
+               <term>virusfilter:block suspected file = false</term>
+               <listitem>
+               <para>With this option on, suspected malware will be blocked as
+               well. Only the <emphasis>fsav</emphasis>scanner supports this
+               option.</para>
+               <para>If this option is not set, the default is false.</para>
+               </listitem>
+               </varlistentry>
+
+       </variablelist>
+</refsect1>
+
+<refsect1>
+       <title>NOTES</title>
+
+       <para>This module can scan other than default streams, if the
+       alternative datastreams are each backed as separate files, such as with
+       the vfs module streams_depot.</para>
+
+       <para>For proper operation the streams support module must be before
+       the virusfilter module in your vfs objects list (i.e. streams_depot
+       must be called before virusfilter module).</para>
+
+       <para>This module is intended for security in depth by providing
+       virus scanning capability on the server. It is not intended to be used
+       in lieu of proper client based security. Other modules for security may


-- 
Samba Shared Repository

Reply via email to