Stefan Metzmacher [Tue, 11 May 2021 08:24:06 +0000 (10:24 +0200)]
Merge branch 'v4-13-stable' into 'v4-13-test' again for the 4.13.9 release
Somehow the samba-4.13.8 was not done in v4-13-stable...
This merge has no changes, but it allows us to sync the
history between v4-13-test and v4-13-stable again.
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Stefan Metzmacher [Tue, 11 May 2021 08:23:07 +0000 (10:23 +0200)]
Revert "VERSION: Bump version up to 4.13.10..." for now
This reverts commit
ca362d33d752459e9f799d49a944247f50e124a2.
Karolin Seeger [Tue, 11 May 2021 07:52:03 +0000 (09:52 +0200)]
VERSION: Bump version up to 4.13.10...
and re-enable GIT_SNAPSHOT
Signed-off-by: Karolin Seeger <kseeger@samba.org>
Karolin Seeger [Tue, 11 May 2021 07:51:07 +0000 (09:51 +0200)]
VERSION: Disable GIT_SNAPSHOT for the Samba 4.13.9 release.
Signed-off-by: Karolin Seeger <kseeger@samba.org>
Karolin Seeger [Tue, 11 May 2021 07:50:16 +0000 (09:50 +0200)]
WHATSNEW: Add release notes for Samba 4.13.9.
Signed-off-by: Karolin Seeger <kseeger@samba.org>
Jeremy Allison [Thu, 29 Apr 2021 16:50:30 +0000 (09:50 -0700)]
s3: smbd: SMB1 SMBsplwr doesn't send a reply packet on success.
Missing call to set up req->outbuf means no reply is sent.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14696
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Apr 29 21:27:58 UTC 2021 on sn-devel-184
(cherry picked from commit
47d79d7e7e406f7dd204ded7c72cfed3e0761ad5)
Autobuild-User(v4-13-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-13-test): Mon May 3 09:06:36 UTC 2021 on sn-devel-184
Andrew Bartlett [Thu, 15 Apr 2021 22:43:07 +0000 (10:43 +1200)]
docs: Expand the "log level" docs on audit logging
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14689
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit
38fe888f95f8d22736080ed521939be932e7bca0)
Andrew Bartlett [Thu, 15 Apr 2021 02:40:30 +0000 (14:40 +1200)]
docs: underline special words in the audit logging part of "log level" in man smb.conf
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14689
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit
d03e7ffcff32452bb92f2ced9f06cbeab9843e04)
Andrew Bartlett [Thu, 15 Apr 2021 02:45:07 +0000 (14:45 +1200)]
docs: Further discourage the use of the "event notification" options
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14689
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit
364b8be9816b34b2a1b07c6259345c406d68c9f2)
Andrew Bartlett [Thu, 15 Apr 2021 02:44:22 +0000 (14:44 +1200)]
docs: Add proper explination on why transactions need to be audited.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14689
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit
a778a3a6420f094a953563b87f84457fdebd20a3)
Andrew Bartlett [Thu, 15 Apr 2021 02:39:49 +0000 (14:39 +1200)]
docs: Add missing documentation on dsdb_group_audit and dsdb_group_audit_json
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14689
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit
2e533664e756ccde8fc1b3e41e70437c9e7bafcd)
Andrew Bartlett [Thu, 15 Apr 2021 01:52:38 +0000 (13:52 +1200)]
debug: Synchronise "log level" in smb.conf with the code
This is done by pasting in the contents of default_classname_table[]
in lib/util/debug.c into
cut -f 2 -d \"| xargs -i sh -c 'echo "\t<listitem><para><parameter moreinfo=\"none\">{}</parameter></para></listitem>"'
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14689
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit
0d30d74e89829cc7b4faa6ba835e3d90c1c410aa)
Karolin Seeger [Thu, 29 Apr 2021 09:11:31 +0000 (11:11 +0200)]
VERSION: Bump version up to 4.13.9.
Signed-off-by: Karolin Seeger <kseeger@samba.org>
Karolin Seeger [Thu, 29 Apr 2021 09:11:10 +0000 (11:11 +0200)]
Merge tag 'samba-4.13.8' into v4-13-test
samba: tag release samba-4.13.8
Karolin Seeger [Mon, 26 Apr 2021 11:09:58 +0000 (13:09 +0200)]
VERSION: Disable GIT_SNAPSHOT for the 4.13.8 release.
BUG 14571: CVE-2021-20254: Buffer overrun in sids_to_unixids().
Signed-off-by: Karolin Seeger <kseeger@samba.org>
Karolin Seeger [Mon, 26 Apr 2021 10:45:26 +0000 (12:45 +0200)]
WHATSNEW: Add release notes for Samba 4.13.8.
Signed-off-by: Karolin Seeger <kseeger@samba.org>
Volker Lendecke [Sat, 20 Feb 2021 14:50:12 +0000 (15:50 +0100)]
CVE-2021-20254 passdb: Simplify sids_to_unixids()
Best reviewed with "git show -b", there's a "continue" statement that
changes subsequent indentation.
Decouple lookup status of ids from ID_TYPE_NOT_SPECIFIED
Bug: https://bugzilla.samba.org/show_bug.cgi?id=14571
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(backported from patch from master)
[backport by npower@samba.org as master commit
493f5d6b078e0b0f80d1ef25043e2834cb4fcb87 and
58e9b62222ad62c81cdf11d704859a227cb2902b creates conflicts
due to rename of WBC_ID_TYPE_* -> ID_TYPE_*]
Karolin Seeger [Mon, 26 Apr 2021 11:08:23 +0000 (13:08 +0200)]
VERSION: Enable GIT_SNAPSHOT.
Signed-off-by: Karolin Seeger <kseeger@samba.org>
Karolin Seeger [Mon, 26 Apr 2021 10:45:26 +0000 (12:45 +0200)]
WHATSNEW: Add release notes for Samba 4.13.8.
Signed-off-by: Karolin Seeger <kseeger@samba.org>
Volker Lendecke [Sat, 20 Feb 2021 14:50:12 +0000 (15:50 +0100)]
CVE-2021-20254 passdb: Simplify sids_to_unixids()
Best reviewed with "git show -b", there's a "continue" statement that
changes subsequent indentation.
Decouple lookup status of ids from ID_TYPE_NOT_SPECIFIED
Bug: https://bugzilla.samba.org/show_bug.cgi?id=14571
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(backported from patch from master)
[backport by npower@samba.org as master commit
493f5d6b078e0b0f80d1ef25043e2834cb4fcb87 and
58e9b62222ad62c81cdf11d704859a227cb2902b creates conflicts
due to rename of WBC_ID_TYPE_* -> ID_TYPE_*]
Stefan Metzmacher [Wed, 24 Mar 2021 10:52:22 +0000 (11:52 +0100)]
VERSION: Bump version up to 4.13.8...
GIT_SNAPSHOT is already 'yes'.
Signed-off-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit
5677103fe7b49ed7738d5df5e5231473c673e08c)
Samuel Cabrero [Thu, 8 Apr 2021 16:45:38 +0000 (18:45 +0200)]
s3-iremotewinspool: set the per-request memory context
The iremotewinspool service is not using the pidl autogenerated code.
Set the per-request memory context following the changes made is commit
5a7e9ade9a4cdfa68900c6a64b639f53c0da47ad.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14675
CI: https://gitlab.com/samba-team/samba/-/merge_requests/1890
Signed-off-by: Samuel Cabrero <scabrero@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Fri Apr 9 15:20:02 UTC 2021 on sn-devel-184
(cherry picked from commit
1efa9ffd7ae77ebf22b28c12dd642a89991b75d2)
Autobuild-User(v4-13-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-13-test): Mon Apr 19 07:53:48 UTC 2021 on sn-devel-184
Martin Schwenke [Mon, 29 Mar 2021 05:30:37 +0000 (16:30 +1100)]
build: Only add -Wl,--as-needed when supported
If -Wl,--as-needed is added to EXTRA_LDFLAGS (via ADD_LDFLAGS, as per
commit
996560191ac6bd603901dcd6c0de5d239e019ef4) then on some
platforms (at least CentOS 8 and Fedora 33), any indirect/recursive
dependencies (i.e. private libraries) are added to both the
binary (reqid_test in the CTDB case) and to samba-util.so. However,
only samba-util.so has rpath set to find private libraries.
When ld.so tries to resolve these dependencies for the binary it
fails. This may be a bug on those platforms, but it occurs reliably
and our users will also hit the bug. For binaries that have other
private library dependencies (e.g. bundled talloc) rpath will contain
the private library directory so the duplicate private library
dependencies are then found... that is, when it works, it works by
accident!
For some reason (deep in waf or wafsamba) if -Wl,--as-needed is added to
LINKFLAGS (as is done in conf.add_as_needed()) then it works: the direct
dependencies are only added to samba-util.so and the same depenencies
(indirect dependencies for binaries) are not added incorrectly to the
binaries.
So, without changing 1/2 of waf/wafsamba the simplest fix is to revert
to adding -Wl,--as-needed to LINKFLAGS, which was the case before
commit
996560191ac6bd603901dcd6c0de5d239e019ef4.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14288
RN: Fix the build on OmniOS
Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Bjoern Jacke <bj@sernet.de>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(backported from commit
ff1c3af603b47a7e8f9faad8d1c2e4a489559155)
Autobuild-User(v4-13-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-13-test): Tue Apr 13 13:16:05 UTC 2021 on sn-devel-184
Ralph Boehme [Mon, 29 Mar 2021 10:24:39 +0000 (12:24 +0200)]
s3: smbd: fix deferred renames
This was broken by
c7a9e0e4cdfb22e66533b5c8e20af3cfdb8ae78c.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14679
CI: https://gitlab.com/samba-team/samba/-/merge_requests/1875
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@amba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Wed Mar 31 06:13:39 UTC 2021 on sn-devel-184
(cherry picked from commit
10d753868e810604d8f60673bbd48f55aaff0797)
Autobuild-User(v4-13-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-13-test): Thu Apr 1 12:19:23 UTC 2021 on sn-devel-184
Jeremy Allison [Tue, 30 Mar 2021 22:05:47 +0000 (15:05 -0700)]
s4: torture. Add smb2.lease.rename_wait test to reproduce regression in delay rename for lease break code.
Passes against Windows 10. Add to knownfail, the
next commit will fix this.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14679
CI: https://gitlab.com/samba-team/samba/-/merge_requests/1875
Back-ported from
8d9a0b8d57713781c72440c7e91746b5d89e6f6a.
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Volker Lendecke [Tue, 23 Mar 2021 16:06:15 +0000 (17:06 +0100)]
rpc_server3: Fix a memleak for internal pipes
state->call should not be talloc'ed off a long-lived context
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14675
CI: https://gitlab.com/samba-team/samba/-/merge_requests/1861
RN: Memory leak in the RPC server
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Samuel Cabrero <scabrero@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Wed Mar 31 12:14:01 UTC 2021 on sn-devel-184
(cherry picked from commit
12f516e4680753460e7fe8811e6c6ff70057580c)
Ralph Boehme [Mon, 22 Mar 2021 11:06:39 +0000 (12:06 +0100)]
spools: avoid leaking memory into the callers mem_ctx
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14675
CI: https://gitlab.com/samba-team/samba/-/merge_requests/1861
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
(cherry picked from commit
481176ec745c14b78fca68e01a61c83405a4b97b)
Ralph Boehme [Tue, 23 Mar 2021 10:40:21 +0000 (11:40 +0100)]
pidl: set the per-request memory context in the pidl generator
The talloc memory context referenced by the pipe_struct mem_ctx member is used
as talloc parent for RPC response data by the RPC service implementations.
In Samba versions up to 4.10 all talloc children of p->mem_ctx were freed after
a RPC response was delivered by calling talloc_free_children(p->mem_ctx). Commit
60fa8e255254d38e9443bf96f2c0f31430be6ab8 removed this call which resulted in all
memory allocations on this context not getting released, which can consume
significant memory in long running RPC connections.
Instead of putting the talloc_free_children(p->mem_ctx) back, just use the
mem_ctx argument of the ${pipename}_op_dispatch_internal() function which is a
dcesrv_call_state object created by dcesrv_process_ncacn_packet() and released
by the RPC server when the RPC request processing is finished.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14675
CI: https://gitlab.com/samba-team/samba/-/merge_requests/1861
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
(cherry picked from commit
4c3fb2a5912966a61e7ebdb05eb3231a0e1d6033)
Ralph Boehme [Tue, 16 Mar 2021 17:18:46 +0000 (18:18 +0100)]
smbd: free open_rec state in remove_deferred_open_message_smb2_internal()
The lifetime of open_rec (struct deferred_open_record) ojects is the time
processing the SMB open request every time the request is scheduled, ie once we
reschedule we must wipe the slate clean. In case the request gets deferred
again, a new open_rec will be created by the schedule functions.
This ensures any timer-event tied to the open_rec gets cancelled and doesn't
fire unexpectedly.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14672
CI: https://gitlab.com/samba-team/samba/-/merge_requests/1843
RN: smbd panic when two clients open same file
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Mar 18 18:04:09 UTC 2021 on sn-devel-184
(cherry picked from commit
591c9196962b695b01c0d86918b8f8a263e9665c)
Autobuild-User(v4-13-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-13-test): Wed Mar 31 10:13:40 UTC 2021 on sn-devel-184
Ralph Boehme [Wed, 17 Mar 2021 15:24:28 +0000 (16:24 +0100)]
smbd: cancel pending poll open timer in poll_open_done()
The retry of the open is scheduled below, avoid rescheduling it a second time in
the open retry timeout function.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14672
CI: https://gitlab.com/samba-team/samba/-/merge_requests/1843
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit
171a58ff3e8ee07cf5d7af08eabcb4a7379e7ce5)
Ralph Boehme [Wed, 17 Mar 2021 15:22:37 +0000 (16:22 +0100)]
smbd: reset dangling watch_req pointer in poll_open_done
We just freed subreq and a pointer to subreq is stored in open_rec->watch_req,
so we must invalidate the pointer.
Otherwise if the poll open timer fires it will do a
TALLOC_FREE(open_rec->watch_req);
on the dangling pointer which may crash or do something worse like freeing some
other random talloc memory.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14672
CI: https://gitlab.com/samba-team/samba/-/merge_requests/1843
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit
065ed088b3d5710c288e46a5bf1e063f9a29c8cc)
Christof Schmitt [Fri, 5 Mar 2021 23:07:54 +0000 (16:07 -0700)]
idmap_nss: Do not return SID from unixids_to_sids on type mismatch
The call to winbind_lookup_name already wrote the result in the id_map
array. The later check for the type detected a mismatch, but that did
not remove the SID from the result struct.
Change this by first assigning the SID to a temporary variable and only
write it to the id_map array after the type checks.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14663
Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Thu Mar 11 08:38:41 UTC 2021 on sn-devel-184
(cherry picked from commit
0e789ba1802ca22e5a01abd6e93ef66cd45566a7)
Christof Schmitt [Fri, 5 Mar 2021 23:01:13 +0000 (16:01 -0700)]
idmap_rfc2307: Do not return SID from unixids_to_sids on type mismatch
The call to winbind_lookup_name already wrote the result in the id_map
array. The later check for the type detected a mismatch, but that did
not remove the SID from the result struct.
Change this by first assigning the SID to a temporary variable and only
write it to the id_map array after the type checks.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14663
Signed-off-by: Christof Schmitt <cs@samba.org>
(cherry picked from commit
79dd4b133c37451c98fe7f7c45da881e89e91ffc)
Christof Schmitt [Fri, 5 Mar 2021 22:48:29 +0000 (15:48 -0700)]
winbind: Only use unixid2sid mapping when module reports ID_MAPPED
Only consider a mapping to be valid when the idmap module reports
ID_MAPPED. Otherwise return the null SID.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14663
Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
(cherry picked from commit
db2afa57e4aa926b478db1be4d693edbdf4d2a23)
Stefan Metzmacher [Wed, 17 Feb 2021 11:57:01 +0000 (12:57 +0100)]
third_party: Update socket_wrapper to version 1.3.3
This fixes a deadlock abort() when SOCKET_WRAPPER_KEEP_PCAP=1
is used.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14640
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Wed Mar 17 23:53:04 UTC 2021 on sn-devel-184
(cherry picked from commit
10c198827d977e07b411897556578d3aedce2184)
Stefan Metzmacher [Tue, 9 Feb 2021 07:56:42 +0000 (08:56 +0100)]
third_party: Update socket_wrapper to version 1.3.2
This brings support for fd-passing of INET sockets.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11899
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit
ab943babc3eb454186558f6e863996dfcf7a20ea)
Stefan Metzmacher [Wed, 24 Mar 2021 10:52:22 +0000 (11:52 +0100)]
VERSION: Bump version up to 4.13.8...
GIT_SNAPSHOT is already 'yes'.
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Stefan Metzmacher [Wed, 24 Mar 2021 10:51:33 +0000 (11:51 +0100)]
Merge tag 'samba-4.13.7' into HEAD
samba: tag release samba-4.13.7
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Karolin Seeger [Wed, 24 Mar 2021 09:59:29 +0000 (10:59 +0100)]
WHATSNEW: Add release notes for Samba 4.13.7.
Signed-off-by: Karolin Seeger <kseeger@samba.org>
Stefan Metzmacher [Wed, 24 Mar 2021 09:24:47 +0000 (10:24 +0100)]
VERSION: Bump version for Samba 4.13.7 release.
o BUG #14595: CVE-2020-27840: Heap corruption via crafted DN strings.
o BUG #14655: CVE-2021-20277: Out of bounds read in AD DC LDAP server.
Note this is exactly the same as 4.13.6, except that it
has a dependency on ldb version 2.2.1, which is needed if
someone builds against a system libldb.
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Karolin Seeger <kseeger@samba.org>
Stefan Metzmacher [Wed, 24 Mar 2021 09:21:56 +0000 (10:21 +0100)]
ldb: version 2.2.1
o BUG #14595: CVE-2020-27840: Heap corruption via crafted DN strings.
o BUG #14655: CVE-2021-20277: Out of bounds read in AD DC LDAP server.
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Karolin Seeger <kseeger@samba.org>
Karolin Seeger [Fri, 19 Mar 2021 09:12:15 +0000 (10:12 +0100)]
VERSION: Disable GIT_SNAPSHOT for the 4.13.6 release.
o BUG #14595: CVE-2020-27840: Heap corruption via crafted DN strings.
o BUG #14655: CVE-2021-20277: Out of bounds read in AD DC LDAP server.
Signed-off-by: Karolin Seeger <kseeger@samba.org>
Karolin Seeger [Fri, 19 Mar 2021 09:11:37 +0000 (10:11 +0100)]
WHATSNEW: Add release notes for Samba 4.13.6.
Signed-off-by: Karolin Seeger <kseeger@samba.org>
Douglas Bagnall [Thu, 11 Feb 2021 03:28:43 +0000 (16:28 +1300)]
CVE-2020-27840: pytests: move Dn.validate test to ldb
We had the test in the Samba Python segfault suite because
a) the signal catching infrastructure was there, and
b) the ldb tests lack Samba's knownfail mechanism, which allowed us to
assert the failure.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14595
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Douglas Bagnall [Fri, 11 Dec 2020 03:32:25 +0000 (16:32 +1300)]
CVE-2020-27840 ldb_dn: avoid head corruption in ldb_dn_explode
A DN string with lots of trailing space can cause ldb_dn_explode() to
put a zero byte in the wrong place in the heap.
When a DN string has a value represented with trailing spaces,
like this
"CN=foo ,DC=bar"
the whitespace is supposed to be ignored. We keep track of this in the
`t` pointer, which is NULL when we are not walking through trailing
spaces, and points to the first space when we are. We are walking with
the `p` pointer, writing the value to `d`, and keeping the length in
`l`.
"CN=foo ,DC= " ==> "foo "
^ ^ ^
t p d
--l---
The value is finished when we encounter a comma or the end of the
string. If `t` is not NULL at that point, we assume there are trailing
spaces and wind `d and `l` back by the correct amount. Then we switch
to expecting an attribute name (e.g. "CN"), until we get to an "=",
which puts us back into looking for a value.
Unfortunately, we forget to immediately tell `t` that we'd finished
the last value, we can end up like this:
"CN=foo ,DC= " ==> ""
^ ^ ^
t p d
l=0
where `p` is pointing to a new value that contains only spaces, while
`t` is still referring to the old value. `p` notices the value ends,
and we subtract `p - t` from `d`:
"CN=foo ,DC= " ==> ? ""
^ ^ ^
t p d
l ~= SIZE_MAX - 8
At that point `d` wants to terminate its string with a '\0', but
instead it terminates someone else's byte. This does not crash if the
number of trailing spaces is small, as `d` will point into a previous
value (a copy of "foo" in this example). Corrupting that value will
ultimately not matter, as we will soon try to allocate a buffer `l`
long, which will be greater than the available memory and the whole
operation will fail properly.
However, with more spaces, `d` will point into memory before the
beginning of the allocated buffer, with the exact offset depending on
the length of the earlier attributes and the number of spaces.
What about a longer DN with more attributes? For example,
"CN=foo ,DC= ,DC=example,DC=com" -- since `d` has moved out of
bounds, won't we continue to use it and write more DN values into
mystery memory? Fortunately not, because the aforementioned allocation
of `l` bytes must happen first, and `l` is now huge. The allocation
happens in a talloc_memdup(), which is by default restricted to
allocating 256MB.
So this allows a person who controls a string parsed by ldb_dn_explode
to corrupt heap memory by placing a single zero byte at a chosen
offset before the allocated buffer.
An LDAP bind request can send a string DN as a username. This DN is
necessarily parsed before the password is checked, so an attacker does
not need proper credentials. The attacker can easily cause a denial of
service and we cannot rule out more subtle attacks.
The immediate solution is to reset `t` to NULL when a comma is
encountered, indicating that we are no longer looking at trailing
whitespace.
Found with the help of Honggfuzz.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14595
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Douglas Bagnall [Thu, 11 Feb 2021 04:05:14 +0000 (17:05 +1300)]
CVE-2020-27840: pytests:segfault: add ldb.Dn validate test
ldb.Dn.validate wraps ldb_dn_explode.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14595
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Douglas Bagnall [Tue, 8 Dec 2020 08:32:09 +0000 (21:32 +1300)]
CVE-2021-20277 ldb/attrib_handlers casefold: stay in bounds
For a string that had N spaces at the beginning, we would
try to move N bytes beyond the end of the string.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14655
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry-picked from commit for master)
Andrew Bartlett [Thu, 11 Mar 2021 22:51:56 +0000 (11:51 +1300)]
CVE-2021-20277 ldb: Remove tests from ldb_match_test that do not pass
This reverts some of the backport of
33a95a1e75b85e9795c4490b78ead2162e2a1f47
This is done here rather than squashed in the cherry-pick of the expanded testsuite
because it allows this commit to be simply reverted for the backport of bug 14044
if this lands first, or to be dropped if bug 14044 lands first.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14655
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Douglas Bagnall [Fri, 5 Mar 2021 07:13:01 +0000 (20:13 +1300)]
CVE-2021-20277 ldb tests: ldb_match tests with extra spaces
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14655
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry-picked from commit for master)
Douglas Bagnall [Fri, 5 Mar 2021 02:47:56 +0000 (15:47 +1300)]
ldb: add tests for ldb_wildcard_compare
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14044
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Björn Jacke <bjacke@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry-picked from commit
33a95a1e75b85e9795c4490b78ead2162e2a1f47)
Karolin Seeger [Tue, 9 Mar 2021 08:16:21 +0000 (09:16 +0100)]
VERSION: Bump version up to 4.13.6...
and re-enable GIT_SNAPSHOT.
Signed-off-by: Karolin Seeger <kseeger@samba.org>
(cherry picked from commit
b30c0416390ce4151a6bf97ea44e18e9d668e596)
Karolin Seeger [Tue, 9 Mar 2021 08:16:21 +0000 (09:16 +0100)]
VERSION: Bump version up to 4.13.6...
and re-enable GIT_SNAPSHOT.
Signed-off-by: Karolin Seeger <kseeger@samba.org>
Karolin Seeger [Tue, 9 Mar 2021 08:15:02 +0000 (09:15 +0100)]
VERSION: Disable GIT_SNAPSHOT for the 4.13.5 release.
Signed-off-by: Karolin Seeger <kseeger@samba.org>
Karolin Seeger [Tue, 9 Mar 2021 08:10:12 +0000 (09:10 +0100)]
Revert "wscript: use --as-needed only if tested successfully"
This reverts commit
eebf510fbd8847077c7bec72a1cda674b5a02714.
Karolin Seeger [Mon, 8 Mar 2021 08:02:43 +0000 (09:02 +0100)]
WHATSNEW: Add release notes for Samba 4.13.5.
Signed-off-by: Karolin Seeger <kseeger@samba.org>
Volker Lendecke [Wed, 3 Mar 2021 18:15:31 +0000 (19:15 +0100)]
g_lock: Fix uninitalized variable reads
If dbwrap_watched_watch_recv() returns IO_TIMEOUT, "blockerdead" might
be an uninitialized non-false, and further down we'll remove the wrong
exclusive locker.
Bug: https://bugzilla.samba.org/show_bug.cgi?id=14636
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Fri Mar 5 11:22:07 UTC 2021 on sn-devel-184
(cherry picked from commit
654c18a244f060d81280493a324b98602a69dbbf)
Autobuild-User(v4-13-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-13-test): Mon Mar 8 09:47:35 UTC 2021 on sn-devel-184
Volker Lendecke [Wed, 3 Mar 2021 18:19:23 +0000 (19:19 +0100)]
locking: Fix an uninitialized variable read
Bug: https://bugzilla.samba.org/show_bug.cgi?id=14636
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit
84b634c613352fc1da8e1525d72597c526d534d2)
Trever L. Adams [Fri, 26 Feb 2021 22:52:03 +0000 (14:52 -0800)]
s3:modules:vfs_virusfilter: Recent talloc changes cause infinite start-up failure
Recent talloc changes cause the current check for failure to allocate to be incorrectly triggered.
This patch checks to see if the original parameter to be checked for NULL if the talloc returns NULL. This allows for rapid passing in the ca
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14634
RN: Fix failure of vfs_virusfilter starting due to talloc changes
Signed-off-by: Trever L. Adams" <trever.adams@gmail.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Noel Power <noel.power@suse.com>
(cherry picked from commit
5a92810082c9a9d2833946ae0d83ce05a6bde597)
Autobuild-User(v4-13-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-13-test): Fri Mar 5 12:18:56 UTC 2021 on sn-devel-184
Björn Jacke [Tue, 2 Mar 2021 21:47:35 +0000 (22:47 +0100)]
wscript: use --as-needed only if tested successfully
Some OSes like Solaris based OmiOS don't support this.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14288
Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit
996560191ac6bd603901dcd6c0de5d239e019ef4)
Peter Eriksson [Tue, 23 Feb 2021 20:13:37 +0000 (12:13 -0800)]
s3: VFS: nfs4_acls. Add missing TALLOC_FREE(frame) in error path.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14648
Signed-off-by: Peter Eriksson <pen@lysator.liu.se>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: David Mulder <dmulder@samba.org>
Autobuild-User(master): David Mulder <dmulder@samba.org>
Autobuild-Date(master): Thu Feb 25 20:46:02 UTC 2021 on sn-devel-184
(cherry picked from commit
3d91fe071a29e2e0c54a10ba081a46cb5c324585)
Autobuild-User(v4-13-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-13-test): Wed Mar 3 09:08:34 UTC 2021 on sn-devel-184
Stefan Metzmacher [Fri, 20 Nov 2020 09:20:14 +0000 (09:20 +0000)]
script/autobuild.py: let cleanup() ignore errors from rmdir_force() by default
It's not useful to generate a python backtrace from within the cleanup code.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14628
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit
9883ac45939f253a63f3ff312fc3912c5f02cdac)
Autobuild-User(v4-14-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-14-test): Tue Feb 2 10:29:44 UTC 2021 on sn-devel-184
(cherry picked from commit
cc1568be4d4250390a9ad03c84f5e260fc7acffd)
Stefan Metzmacher [Fri, 20 Nov 2020 09:20:14 +0000 (09:20 +0000)]
script/autobuild.py: split out a rmdir_force() helper function
That also tries to re-add write permissions before removing.
In future we'll have jobs changing there directory to read-only.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14628
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit
7a5df2deaaf62a7edd7c64251f75ab15abe94c07)
(cherry picked from commit
c933135969be29072971f96481b05f499fd48b57)
Stefan Metzmacher [Sun, 22 Nov 2020 22:28:31 +0000 (23:28 +0100)]
selftest: make/use a copy of GNUPGHOME
That makes it possible to run tests from a read only source tree.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14628
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit
86343125a55d184c15aa94cd01f4c8893a5a0917)
(cherry picked from commit
c1a4cb97d1d71b974eed2ecb5f34bb1425f36294)
Stefan Metzmacher [Sun, 22 Nov 2020 21:43:36 +0000 (22:43 +0100)]
s4:selftest: use plansmbtorture4testsuite() for 'rpc.echo'
This makes sure "--basedir=$SELFTEST_TMPDIR" is passed to smbtorture.
Tests should not create files in the build nor the source directory!
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14628
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit
d06f2c22d726a5ec7bd804d89154ee272ab1a679)
(cherry picked from commit
81b36b389cb01eca9b2f0a2a452d290e21f31394)
Stefan Metzmacher [Thu, 17 Dec 2020 05:38:14 +0000 (06:38 +0100)]
s3:selftest: run test_smbclient_tarmode.pl with a fixed subdirectory name
$PREFIX is the the value from --with-selftest-prefix.
The result of the test should not depend on --with-selftest-prefix,
the 'long_path' test in particular.
If the path is to long smbclient (via libarchive) will only
put the full path into a PAX HEADER as 'path' keyword,
that's fine in general, modern tools handle it just fine.
But Perl's Archive::Tar don't handle it and only seems
truncated file names.
I have a fix for Archive::Tar, see:
https://git.samba.org/?p=metze/samba/wip.git;a=shortlog;h=
c75037d0a06a96cdaca3f3b20a6d237e768b075b
But finishing that is a task for another day, for now I just want to remove
the dependency to --with-selftest-prefix.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14628
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit
e0d9b656452ba6277cdc7f0abb2a06d3d284ef3a)
(cherry picked from commit
3eba14718dd6269fe1657de15a2f47c848b60518)
Stefan Metzmacher [Mon, 23 Nov 2020 10:35:33 +0000 (11:35 +0100)]
selftest/Samba4: allow get_cmd_env_vars() to take an overwrite dictionary
This way we can use it on even in some special cases, where we combine
variables from multiple environments.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14628
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit
568c7d38debaa5ccd90d6ea33c683de512de7005)
(cherry picked from commit
f1c7967b568034da2707ccc4bd1f64358d55eacc)
Stefan Metzmacher [Mon, 23 Nov 2020 10:35:33 +0000 (11:35 +0100)]
selftest/Samba4: correctly pass KRB5CCNAME to provision
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14628
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit
dce0bdc39ebb01ef4f5e35af0552451cfc29fd1b)
(cherry picked from commit
85800df90358f3a76b6b86f8414582178fe50946)
Stefan Metzmacher [Mon, 23 Nov 2020 10:35:33 +0000 (11:35 +0100)]
selftest/Samba4: make more use of get_cmd_env_vars()
This simplifies the code a lot and makes it much easier to
add new environment variables in future.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14628
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit
15b39160406c3ef49c5f074793d3a55b3bf12e0e)
(cherry picked from commit
9d5f5e821cbe23cc2e64f201e7409aaec4b50387)
Stefan Metzmacher [Thu, 17 Dec 2020 09:42:03 +0000 (10:42 +0100)]
selftest:Samba4: avoid File::Path 'make_path' in setup_dns_hub_internal()
While spliting the build and test stages I hit strange permission
problems, when a parent directory is missing,
which can be avoided by using plain mkdir() on each level.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14628
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit
719eccd445e9cc56a1c2988c4deeb39d301bcbff)
(cherry picked from commit
56c2c0f651e1c038ecf87a14a7dbe478e5e58d8d)
Stefan Metzmacher [Thu, 19 Nov 2020 16:19:53 +0000 (16:19 +0000)]
selftest: allow a prefix under /m/username/
We only want to match/replace only a '.' pathname component
not any single character pathname compoment!
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14628
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit
02301222386f2f08631d48d6e88c03cd1439325d)
(cherry picked from commit
f480161b754aade6c1af2d05f3ce742466b28026)
Stefan Metzmacher [Mon, 23 Nov 2020 09:38:49 +0000 (10:38 +0100)]
Makefile: add support for 'make testonly'
That skips any attempt to recompile before running the tests.
Some times that's useful for debugging and we'll
use it to split the build and test stages in autobuild and gitlab-ci
later.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14628
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit
1e4714940211b10ae6574770f15b7c6ed95f5f59)
(cherry picked from commit
9fed2749c039164794faadef71aa83cfd360d130)
Ralph Boehme [Mon, 21 Sep 2020 05:48:43 +0000 (07:48 +0200)]
s3: fix fcntl waf configure check
RN: Fix fcntl waf configure check
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14503
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Mon Sep 21 07:26:54 UTC 2020 on sn-devel-184
(cherry picked from commit
454ccd986b61799908a6898a55d0480911f15306)
Autobuild-User(v4-13-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-13-test): Fri Feb 26 10:57:20 UTC 2021 on sn-devel-184
Jeremy Allison [Wed, 27 Jan 2021 05:29:58 +0000 (21:29 -0800)]
smbd: In conn_force_tdis_done() when forcing a connection closed force a full reload of services.
Prevents reload_services() caching the fact it might be
called multiple times in a row.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14604
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit
e4c8cd0781aef2a29bb4db1314c9fcd4f6edcecd)
Autobuild-User(v4-13-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-13-test): Fri Feb 26 08:50:23 UTC 2021 on sn-devel-184
Andrew Bartlett [Thu, 10 Dec 2020 03:03:49 +0000 (16:03 +1300)]
dbcheck: Check Deleted Objects and reduce noise in reports about expired tombstones
These reports (about recently deleted objects)
create concern about a perfectly normal part of DB operation.
We must not operate on objects that are expired or we might reanimate them,
but we must fix "Deleted Objects" if it is wrong (mostly it is set as being
deleted in 9999, but in alpha19 we got this wrong).
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14593
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Feb 3 05:29:11 UTC 2021 on sn-devel-184
(cherry picked from commit
da627106cdbf8d375b25fa3338a717447f3dbb6e)
Autobuild-User(v4-13-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-13-test): Mon Feb 22 12:58:04 UTC 2021 on sn-devel-184
Andrew Bartlett [Fri, 11 Dec 2020 02:37:04 +0000 (15:37 +1300)]
selftest: Confirm that we fix any errors on the Deleted Objects container itself
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14593
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
(cherry picked from commit
1ec1c35a3ae422720df491f5555c9bc787c9944c)
Björn Jacke [Fri, 5 Feb 2021 11:47:01 +0000 (12:47 +0100)]
classicupgrade: treat old never expires value right
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14624
Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Wed Feb 10 15:06:49 UTC 2021 on sn-devel-184
(cherry picked from commit
df75d82c9de6977c466ee9f01886cb012a9c5fef)
Autobuild-User(v4-13-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-13-test): Tue Feb 16 17:16:21 UTC 2021 on sn-devel-184
Stefan Metzmacher [Tue, 9 Feb 2021 12:48:36 +0000 (13:48 +0100)]
s3:pysmbd: fix fd leak in py_smbd_create_file()
Various 'samba-tool domain backup' commands use this and will
fail if there's over ~1000 files in the sysvol folder.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13898
Signed-off-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit
d8fa464a2dfb11df4e1db4ebffe8bd28ff118c75)
Paul Wise [Mon, 29 Feb 2016 17:58:45 +0000 (11:58 -0600)]
HEIMDAL: krb5_storage_free(NULL) should work
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12505
Signed-off-by: Paul Wise <pabs3@bonedaddy.net>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Original-author: Nicolas Williams <nico@twosigma.com>
(cherry-picked from heimdal commit
b3db07d5f0e03f6a1a0a392e70f9675e19a6d6af)
(cherry picked from commit
f9ed4f7028a5ed29026ac8ef1b47b63755ba98f8)
Andreas Schneider [Tue, 2 Feb 2021 17:10:38 +0000 (18:10 +0100)]
lib:util: Avoid free'ing our own pointer
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14625
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit
0bdbe50fac680be3fe21043246b8c75005611351)
Autobuild-User(v4-13-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-13-test): Mon Feb 8 11:42:58 UTC 2021 on sn-devel-184
Andreas Schneider [Wed, 3 Feb 2021 09:37:12 +0000 (10:37 +0100)]
lib:util: Add cache oversize test for memcache
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14625
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit
00543ab3b29e3fbfe8314e51919629803e14ede6)
Andreas Schneider [Wed, 3 Feb 2021 09:30:08 +0000 (10:30 +0100)]
lib:util: Add basic memcache unit test
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14625
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit
bebbf621d6052f797c5cf19a2a9bbc13e699d3f0)
Jeremy Allison [Thu, 4 Feb 2021 01:43:08 +0000 (17:43 -0800)]
s3: libsmb: Add missing cli_tdis() in error path if encryption setup failed on temp proxy connection.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13992
Signed-off-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Thu, 28 Jan 2021 19:08:48 +0000 (11:08 -0800)]
s3: libsmb: cli_state_save_tcon(). Don't deepcopy tcon struct when temporarily swapping out a connection on a cli_state.
This used to make a deep copy of either
cli->smb2.tcon or cli->smb1.tcon, but this leaves
the original tcon pointer in place which will then get
TALLOC_FREE()'d when the new tree connection is made on
this cli_state.
As there may be pipes open on the old tree connection with
talloc'ed state allocated using the original tcon pointer as a
talloc parent we can't deep copy and then free this pointer
as that will fire the destructors on the pipe memory and
mark them as not connected.
This call is used to temporarily swap out a tcon pointer
(whilst keeping existing pipes open) to allow a new tcon
on the same cli_state and all users correctly call
cli_state_restore_tcon() once they are finished with
the new tree connection.
Just return the existing pointer and set the old value to NULL.
We know we MUST be calling cli_state_restore_tcon() below
to restore the original tcon tree connection pointer before
closing the session.
Remove the knownfail.d entry.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13992
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Feb 2 21:05:25 UTC 2021 on sn-devel-184
(cherry picked from commit
4f80f5f9046b64a9e5e0503b1cb54f1492c4faec)
Autobuild-User(v4-13-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-13-test): Wed Feb 3 21:23:36 UTC 2021 on sn-devel-184
Jeremy Allison [Fri, 29 Jan 2021 01:35:55 +0000 (17:35 -0800)]
s3: torture: Change the SMB1-only UID-REGRESSION-TEST to do an explicit copy of the tcon struct in use.
For this test only, explicitly copy the SMB1 tcon struct,
don't use cli_state_save_tcon()//cli_state_restore_tcon()
as these calls will soon change to just manipulate the pointer
to avoid TALLOC_FREE() on the tcon struct which calls
destructors on child pipe data.
In SMB1 this test calls cli_tdis() twice with an invalid
vuid and expects the SMB1 tcon struct to be preserved
across the calls.
SMB1 cli_tdis() frees cli->smb1.tcon so we must put back
a deep copy into cli->smb1.tcon to be able to safely call
cli_tdis() again.
This is a test-only hack. Real client code
uses cli_state_save_tcon()/cli_state_restore_tcon()
if it needs to temporarily swap out the active
tcon on a client connection.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13992
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit
e93e6108837eff0cebad8dc26d055c0e1386093a)
Jeremy Allison [Thu, 28 Jan 2021 18:56:18 +0000 (10:56 -0800)]
s3: smbtorture3: Ensure run_tcon_test() always replaces any saved tcon and shuts down correctly even in error paths.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13992
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit
f9ca91bd293e9f2710c4449c5d4f5d016a066049)
Jeremy Allison [Thu, 28 Jan 2021 18:46:33 +0000 (10:46 -0800)]
s3: smbtorture3: Ensure we *always* replace the saved saved_tcon even in an error condition.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13992
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit
dc701959cad7bf15aa47cad6451212606520f67f)
Jeremy Allison [Thu, 28 Jan 2021 22:07:23 +0000 (14:07 -0800)]
s3: tests: Add regression test for bug 13992.
Subtle extra test. Mark as knownfail for now.
'^ user1$' must appear MORE THAN ONCE, as it can read more than one
share. The previous test found user1, but only once as the bug only
allows reading the security descriptor for one share, and we were
unlucky that the first share security descriptor returned allows
user1 to read from it.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13992
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit
068f4a977f0539f790809d580bf22d2362032e3d)
Ralph Boehme [Sat, 23 Jan 2021 17:36:23 +0000 (18:36 +0100)]
smbd: use fsp->conn->session_info for the initial delete-on-close token
There's a correctly set up session_info at fsp->conn->session_info, we can just
use that.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14617
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Jan 26 04:04:14 UTC 2021 on sn-devel-184
(cherry picked from commit
e06f86bbd93d024c70016e1adcf833db85742aca)
Autobuild-User(v4-13-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-13-test): Mon Feb 1 08:47:05 UTC 2021 on sn-devel-184
Ralph Boehme [Mon, 25 Jan 2021 10:48:32 +0000 (11:48 +0100)]
selftest: add a test that verifies unlink works when "force user" is set
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14617
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit
aa1f09cda0a097617e34dd0a8b1b0acc7a37bca8)
Ralph Boehme [Mon, 25 Jan 2021 10:47:45 +0000 (11:47 +0100)]
selftest: add force_user_error_inject share in maptoguest env
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14617
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit
f3f8fdfbf10f690bc8d972a13d6f74f1fb0fb375)
Ralph Boehme [Mon, 25 Jan 2021 10:46:30 +0000 (11:46 +0100)]
vfs_error_inject: add unlinkat hook
Note that a failure is only injected if the owner of the parent directory is not
the same as the current user.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14617
Back-ported from commit
c44dad3ac2eb36fc5eb5a9f80a9ef97183be26ef.
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Ralph Boehme [Fri, 15 Jan 2021 11:56:25 +0000 (12:56 +0100)]
s3/auth: implement "winbind:ignore domains"
Under the following conditions a user from an ignored domain might be able to
authenticate:
- using Kerberos
- successfully previous authentication so the idmap and name caches are filled
- winbind not running (fwiw, winbindd is mandatory on a domain member)
- nscd running with a cached getpwnam for the ignored user (otherwise auth fails
because getpwnam fails)
- lookup_name() function being modified to look into the name cache before
contacting winbindd. Currently it talks directly to winbindd and that will
check the cache.
Currently, authentication will only fail because creating the local token for
the user fails because an LSA lookupname RPC call fails (because winbindd is not
running).
All of this makes a successfull authentication unlikelly, but that is more by
accident then by design.
To ensures that if winbindd is not running and as such winbindd itself can not
enforce the restriction, also implement the ignored domains check in the auth
system as a last line of defense.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14602
RN: "winbind:ignore domains" doesn't prevent user login from trusted domain
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit
df5fe2d835169161d3930acf1e9c750dd2bc64b6)
Ralph Boehme [Thu, 14 Jan 2021 09:42:53 +0000 (10:42 +0100)]
winbind: check for allowed domains in winbindd_pam_auth_pac_verify()
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14602
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit
da474ddd13d84f07f5da81c843e651844f33a003)
Ralph Boehme [Mon, 11 Jan 2021 16:59:48 +0000 (17:59 +0100)]
winbind: check for allowed domains in winbindd_dual_pam_chauthtok()
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14602
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit
88e92faace7ec17810903166fa3433aa4842a4e3)
Ralph Boehme [Mon, 11 Jan 2021 16:19:05 +0000 (17:19 +0100)]
winbind: check for allowed domains in winbindd_dual_pam_chng_pswd_auth_crap()
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14602
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit
4bc17600bc50fbc0e54d9d019d8db67001fc3eef)
Ralph Boehme [Mon, 11 Jan 2021 16:10:19 +0000 (17:10 +0100)]
winbind: check for allowed domains in winbindd_dual_pam_auth_crap()
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14602
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit
c17bc9c6115e4e92132f3cb912547eac78227938)
Ralph Boehme [Mon, 11 Jan 2021 15:50:31 +0000 (16:50 +0100)]
winbind: check for allowed domains in winbindd_dual_pam_auth()
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14602
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit
4cefdf03fec91cdcf700922b1a5ceca02407e259)
Ralph Boehme [Mon, 11 Jan 2021 15:15:15 +0000 (16:15 +0100)]
winbind: move "winbind:ignore domain" logic to a seperate function
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14602
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit
894caca79476d25a0268d89b2ad8a5758b7e31f3)
Ralph Boehme [Wed, 13 Jan 2021 10:54:40 +0000 (11:54 +0100)]
selftest: add a test for "winbind:ignore domains"
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14602
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit
32197d21dabecaee9bc1d6cd557578892220fe4c)
Ralph Boehme [Wed, 20 Jan 2021 11:00:16 +0000 (12:00 +0100)]
winbind: handle MSG_SMB_CONF_UPDATED in the winbinds children
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14602
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit
072ef48001710ed8326c83295f2d3cc301d27cfe)