Karolin Seeger [Tue, 21 Apr 2020 11:23:38 +0000 (13:23 +0200)]
VERSION: Disable GIT_SNAPSHOT for the 4.11.8 release.
o CVE-2020-10700: Use-after-free in Samba AD DC LDAP Server with ASQ
o CVE-2020-10704: LDAP Denial of Service (stack overflow) in Samba AD DC
Signed-off-by: Karolin Seeger <kseeger@samba.org>
Karolin Seeger [Tue, 21 Apr 2020 11:23:09 +0000 (13:23 +0200)]
WHATSNEW: Add release notes for Samba 4.11.8.
Signed-off-by: Karolin Seeger <kseeger@samba.org>
Gary Lockyer [Tue, 7 Apr 2020 22:46:44 +0000 (10:46 +1200)]
CVE-2020-10704 libcli ldap: Check search request lengths.
Check the search request lengths against the limits passed to
ldap_decode.
Credit to OSS-Fuzz
REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20454
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14334
Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Gary Lockyer [Tue, 7 Apr 2020 20:49:23 +0000 (08:49 +1200)]
CVE-2020-10704: libcli ldap_message: Add search size limits to ldap_decode
Add search request size limits to ldap_decode calls.
The ldap server uses the smb.conf variable
"ldap max search request size" which defaults to 250Kb.
For cldap the limit is hard coded as 4096.
Credit to OSS-Fuzz
REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20454
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14334
Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Gary Lockyer [Wed, 8 Apr 2020 03:32:22 +0000 (15:32 +1200)]
CVE-2020-10704: S4 ldap server: Limit request sizes
Check the size of authenticated and anonymous ldap requests and reject
them if they exceed the limits in smb.conf
Credit to OSS-Fuzz
REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20454
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14334
Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Gary Lockyer [Mon, 6 Apr 2020 21:09:01 +0000 (09:09 +1200)]
CVE-2020-10704: smb.conf: Add max ldap request sizes
Add two new smb.conf parameters to control the maximum permitted ldap
request size.
Adds:
ldap max anonymous request size default 250Kb
ldap max authenticated request size default 16Mb
Credit to OSS-Fuzz
REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20454
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14334
Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Gary Lockyer [Tue, 14 Apr 2020 01:32:32 +0000 (13:32 +1200)]
CVE-2020-10704: ldapserver tests: Limit search request sizes
Add tests to ensure that overly long (> 256000 bytes) LDAP search
requests are rejected.
Credit to OSS-Fuzz
REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20454
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14334
Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Gary Lockyer [Wed, 8 Apr 2020 03:30:52 +0000 (15:30 +1200)]
CVE-2020-10704: lib util asn1: Check parse tree depth
Check the current depth of the parse tree and reject the input if the
depth exceeds that passed to asn1_init
Credit to OSS-Fuzz
REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20454
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14334
Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Gary Lockyer [Thu, 2 Apr 2020 02:25:53 +0000 (15:25 +1300)]
CVE-2020-10704: libcli ldap: test recursion depth in ldap_decode_filter_tree
Add tests to check that ASN.1 ldap requests with deeply nested elements
are rejected. Previously there was no check on the on the depth of
nesting and excessive nesting could cause a stack overflow.
Credit to OSS-Fuzz
REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20454
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14334
Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Gary Lockyer [Thu, 2 Apr 2020 23:18:03 +0000 (12:18 +1300)]
CVE-2020-10704: lib util asn1: Add ASN.1 max tree depth
Add maximum parse tree depth to the call to asn1_init, which will be
used to limit the depth of the ASN.1 parse tree.
Credit to OSS-Fuzz
REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20454
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14334
Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Karolin Seeger [Fri, 17 Apr 2020 11:28:52 +0000 (13:28 +0200)]
CVE-2020-10700: ldb: Bump version up to 2.0.10.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14331
Signed-off-by: Karolin Seeger <kseeger@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Andrew Bartlett [Wed, 11 Mar 2020 03:43:31 +0000 (16:43 +1300)]
CVE-2020-10700: dsdb: Do not permit the ASQ control for the GUID search in paged_results
ASQ is a very strange control and a BASE search can return multiple results
that are NOT the requested DN, but the DNs pointed to by it!
Thanks to Andrei Popa <andrei.popa@next-gen.ro> for finding,
reporting and working with us to diagnose this issue!
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14331
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Andrew Bartlett [Wed, 11 Mar 2020 03:41:34 +0000 (16:41 +1300)]
CVE-2020-10700: ldb: Always use ldb_next_request() in ASQ module
We want to keep going down the module stack, and not start from the top again.
ASQ is above the ACL modules, but below paged_results and we do not wish to
re-trigger that work.
Thanks to Andrei Popa <andrei.popa@next-gen.ro> for finding,
reporting and working with us to diagnose this issue!
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14331
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Andrew Bartlett [Mon, 30 Mar 2020 09:44:20 +0000 (09:44 +0000)]
CVE-2020-10700: dsdb: Add test for ASQ and ASQ in combination with paged_results
Thanks to Andrei Popa <andrei.popa@next-gen.ro> for finding,
reporting and working with us to diagnose this issue!
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14331
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Karolin Seeger [Tue, 10 Mar 2020 09:55:01 +0000 (10:55 +0100)]
VERSION: Bump version up to 4.11.8...
and re-enable GIT_SNAPSHOT.
Signed-off-by: Karolin Seeger <kseeger@samba.org>
(cherry picked from commit
46e19f9f40258855d84e747bcb02019262e72057)
Karolin Seeger [Tue, 10 Mar 2020 09:54:25 +0000 (10:54 +0100)]
VERSION: Disable GIT_SNAPSHOT for the 4.11.7 release.
Signed-off-by: Karolin Seeger <kseeger@samba.org>
Karolin Seeger [Tue, 10 Mar 2020 09:53:56 +0000 (10:53 +0100)]
WHATSNEW: Add release notes for Samba 4.11.7.
Signed-off-by: Karolin Seeger <kseeger@samba.org>
Andrew Bartlett [Thu, 30 Jan 2020 03:44:05 +0000 (16:44 +1300)]
selftest: Test behaviour of DNS scavenge with an existing dNSTombstoned value
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14258
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Thu Feb 6 16:24:25 UTC 2020 on sn-devel-184
(cherry picked from commit
c8e3c78d4f2a6f3e122fe458aa6835772290a700)
Autobuild-User(v4-11-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-11-test): Wed Feb 26 13:53:10 UTC 2020 on sn-devel-184
Andrew Bartlett [Thu, 30 Jan 2020 03:41:39 +0000 (16:41 +1300)]
dsdb: Correctly handle memory in objectclass_attrs
el->values is caller-provided memory that should be thought of as constant,
it should not be assumed to be a talloc context.
Otherwise, if the caller gives constant memory or a stack
pointer we will get an abort() in talloc when it expects
a talloc magic in the memory preceeding the el->values.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14258
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit
3657bbc21182d764ddfcd603025f24ec240fd263)
Andrew Bartlett [Tue, 25 Feb 2020 21:29:20 +0000 (10:29 +1300)]
ldb: version 2.0.9
* Bug 14270:
Samba 4.11 and later give incorrect results for SCOPE_ONE searches
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(v4-11-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-11-test): Wed Feb 26 10:08:45 UTC 2020 on sn-devel-184
Andrew Bartlett [Wed, 12 Feb 2020 03:28:01 +0000 (16:28 +1300)]
ldb: Add tests aimed at the SCOPE_ONELEVEL bug in particular
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14270
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit
0b8ab0200805127e36eeb2affe561f3aee59604a)
Andrew Bartlett [Fri, 7 Feb 2020 03:56:13 +0000 (16:56 +1300)]
ldb: Fix search with scope ONE and small result sets
This changes the LDB behaviour in the combination of a SCOPE_ONE search and
an index returning less than 10 results.
After
b6b5b5fe355fee2a4096e9214831cb88c7a2a4c6 the list->strict flag
became set to false in all cases, rather than being left to the
value set by the caller.
This changes the ldb_kv_index_dn_one() code to force strict
mode on success instead.
Thanks to Marcus Granér, ICEYE Oy for reporting.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14270
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit
3c7261c43da491b57f50e0e64d7050d85c6b973e)
Andrew Bartlett [Wed, 12 Feb 2020 00:44:44 +0000 (13:44 +1300)]
ldb: Ensure @IDXONE modes is tested in ldb.python (apy.py) tests
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit
ec34a7095705592279647c5046a000e0bf052d1a)
Andrew Bartlett [Tue, 11 Feb 2020 22:45:36 +0000 (11:45 +1300)]
ldb: Add tests aimed at the SCOPE_ONELEVEL particular
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14270
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit
167676973b7f1db563da04d54e8ce5668034081c)
Andrew Bartlett [Mon, 10 Feb 2020 01:08:29 +0000 (14:08 +1300)]
ldb: Add tests for one-level indexes in conjunction with other indexes
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14270
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit
17bd63dbea7f6e6358f81f0ac5b9392b2321bb32)
Volker Lendecke [Thu, 20 Feb 2020 13:13:35 +0000 (14:13 +0100)]
smbd: Separate aio_pthread indicator from normal EINTR
According to Posix and the Linux open(2) manpage, the open-syscall can
return EINTR. If that happens, core smbd saw this as an indication
that aio_pthread's open function was doing its job. With a real EINTR
without aio_pthread this meant we ended up in a server_exit after 20
seconds, because there was nobody to do the retry.
EINTR is mapped to NT_STATUS_RETRY. Handle this by just retrying after
a second.
Bug: https://bugzilla.samba.org/show_bug.cgi?id=14285
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Feb 20 22:14:25 UTC 2020 on sn-devel-184
(cherry picked from commit
aebe427b77b5315eb5d2b05b8c72824ca0389723)
Autobuild-User(v4-11-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-11-test): Tue Feb 25 22:24:54 UTC 2020 on sn-devel-184
Volker Lendecke [Thu, 20 Feb 2020 09:25:16 +0000 (10:25 +0100)]
lib: Map EINPROGRESS->NT_STATUS_MORE_PROCESSING_REQUIRED
Bug: https://bugzilla.samba.org/show_bug.cgi?id=14285
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit
4a943d842a51674425f0c4019f823ef0a9d09f49)
Volker Lendecke [Wed, 19 Feb 2020 14:25:38 +0000 (15:25 +0100)]
test: Show that smbd does not handle EINTR from open() correctly
Bug: https://bugzilla.samba.org/show_bug.cgi?id=14285
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit
7bbba73b30f06304e9a2ad48e853d9ec8171dd30)
Volker Lendecke [Wed, 19 Feb 2020 13:44:11 +0000 (14:44 +0100)]
test: Intercept open in vfs_error_inject
Bug: https://bugzilla.samba.org/show_bug.cgi?id=14285
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit
305204a241b74c599f4f6a064cac6608afd9c893)
Andreas Schneider [Wed, 5 Feb 2020 15:58:26 +0000 (16:58 +0100)]
wafsamba: Do not use 'rU' as the 'U' is deprecated in Python 3.9
See https://docs.python.org/3.9/whatsnew/3.9.html#changes-in-the-python-api
"open(), io.open(), codecs.open() and fileinput.FileInput no longer accept 'U'
(“universal newline”) in the file mode. This flag was deprecated since Python
3.3. In Python 3, the “universal newline” is used by default when a file is
open in text mode. The newline parameter of open() controls how universal
newlines works."
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14266
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Thu Feb 6 07:30:13 UTC 2020 on sn-devel-184
(cherry picked from commit
52722746a5eb40c309ba59f78bd8e3d897417bdc)
Jeremy Allison [Wed, 19 Feb 2020 21:20:14 +0000 (13:20 -0800)]
s3: VFS: full_audit. Use system session_info if called from a temporary share definition.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14283
Signed-off-by: Jeremy Allison <jra@samba.org>
Autobuild-User(v4-11-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-11-test): Fri Feb 21 09:20:14 UTC 2020 on sn-devel-184
Volker Lendecke [Wed, 12 Feb 2020 14:40:32 +0000 (15:40 +0100)]
auth: Fix CID
1458418 Null pointer dereferences (REVERSE_INULL)
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14247
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit
ef0350221e194a3dd3350eab02b38baeb32d8fd3)
Autobuild-User(v4-11-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-11-test): Wed Feb 19 06:19:13 UTC 2020 on sn-devel-184
Volker Lendecke [Wed, 12 Feb 2020 14:39:54 +0000 (15:39 +0100)]
auth: Fix CID
1458420 Null pointer dereferences (REVERSE_INULL)
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14247
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit
503fc8f2ba662ecbec0788bd1710440464dc5cfd)
Martin Schwenke [Tue, 28 Jan 2020 05:49:14 +0000 (16:49 +1100)]
ctdb-tcp: Make error handling for outbound connection consistent
If we can't bind the local end of an outgoing connection then
something has gone wrong. Retrying is better than failing into a
zombie state. The interface might come back up and/or the address my
be reconfigured.
While here, do the same thing for the other (potentially transient)
failures.
The unknown address family failure is special but just handle it via a
retry. Technically it can't happen because the node address parsing
can only return values with address family AF_INET or AF_INET6.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14274
RN: Retry inter-node TCP connections on more transient failures
Reported-by: 耿纪超 <gengjichao@jd.com>
Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
(cherry picked from commit
a40fc709cc972dadb40efbf1394b10fae3cfcc07)
Autobuild-User(v4-11-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-11-test): Mon Feb 17 13:13:01 UTC 2020 on sn-devel-184
Stefan Metzmacher [Wed, 22 Jan 2020 17:00:07 +0000 (17:00 +0000)]
winbindd: handling missing idmap in getgrgid()
A similar hunk was added via commit
89f753c1fc824fef29aebb7d783ab7e09cd1f04e ("winbind: Use xids2sids in getpwuid"),
but it was missing in commit
e2dda192e7f8b65a5f02120be56cf0f07d03679f ("winbind: Use xids2sids in getgrgid")
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14265
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Wed Feb 5 17:56:58 UTC 2020 on sn-devel-184
(cherry picked from commit
4d0bda9467ac3f45f85f48a281cdb173ce1064eb)
Autobuild-User(v4-11-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-11-test): Tue Feb 11 13:08:14 UTC 2020 on sn-devel-184
Stefan Metzmacher [Thu, 23 Jan 2020 15:21:43 +0000 (16:21 +0100)]
s3:auth_sam: map an empty domain or '.' to the local SAM name
When a domain member gets an empty domain name or '.', it should
not forward the authentication to domain controllers of
the primary domain.
But we need to keep passing UPN account names with
an empty domain to the DCs as a domain member.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14247
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit
590df382bea44eec2dbfd2a28c659b0a29188bca)
Stefan Metzmacher [Tue, 4 Feb 2020 10:32:05 +0000 (11:32 +0100)]
s3:selftest: test authentication with an empty userdomain and upn names
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14247
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit
a9eeea6ef78cc44c8423c7125fa1376921060018)
Stefan Metzmacher [Thu, 23 Jan 2020 15:21:43 +0000 (16:21 +0100)]
s3:auth_sam: introduce effective_domain helper variables
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14247
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit
a63e2a312c761093fedb09bd234b6736485a930a)
Stefan Metzmacher [Thu, 23 Jan 2020 15:17:30 +0000 (16:17 +0100)]
s3:auth_sam: make sure we never handle empty usernames
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14247
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit
01b8374e7942141e7f6cbdec7623c981a008e4c1)
Stefan Metzmacher [Thu, 23 Jan 2020 15:13:59 +0000 (16:13 +0100)]
s3:auth_sam: unify the debug messages of all auth_sam*_auth() functions
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14247
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit
72ef8d3a52c1ab07c079a4c014ba8ac7bff528f7)
Stefan Metzmacher [Thu, 23 Jan 2020 14:48:39 +0000 (15:48 +0100)]
s3:auth_sam: replace confusing FALL_THROUGH; with break;
There's no real logic change here, but is makes it easier to
understand.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14247
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit
85b168c6dac88f5065c0ec6e925937439f2c12ed)
Karolin Seeger [Tue, 28 Jan 2020 10:48:53 +0000 (11:48 +0100)]
script/release.sh: Don't use quotations any longer.
Signed-off-by: Karolin Seeger <kseeger@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(master): Mon Feb 3 12:45:39 UTC 2020 on sn-devel-184
(cherry picked from commit
f699df32cdbae4fbc585c259828029c74163323b)
Autobuild-User(v4-11-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-11-test): Tue Feb 4 11:53:54 UTC 2020 on sn-devel-184
Andreas Schneider [Thu, 30 Jan 2020 15:18:25 +0000 (16:18 +0100)]
s4:torture: Skip the deltest20 as user root
The test is meant to be run as a user and not root.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14257
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Thu Jan 30 16:54:33 UTC 2020 on sn-devel-184
(cherry picked from commit
677bc1b18420e717154dc73f632044239ac3ff9e)
Autobuild-User(v4-11-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-11-test): Fri Jan 31 12:31:10 UTC 2020 on sn-devel-184
Andreas Schneider [Mon, 27 Jan 2020 13:58:10 +0000 (14:58 +0100)]
lib:util: Log mkdir error on correct debug levels
For smbd we want an error and for smbclient we only want it in NOTICE
debug level.
The default log level of smbclient is log level 1 so we need notice to
not spam the user.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14253
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Mon Jan 27 15:55:24 UTC 2020 on sn-devel-184
(cherry picked from commit
0ad6a243b259d284064c0c5abcc7d430d55be7e1)
Jeremy Allison [Fri, 17 Jan 2020 21:49:48 +0000 (13:49 -0800)]
s3: lib: nmblib. Clean up and harden nmb packet processing.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14239
OSS-FUZZ: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20156
OSS-FUZZ: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20157
Credit to oss-fuzz.
No security implications.
Signed-off-by: Jeremy Allison <jra@samba.org>
Pair programmed with: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Jan 21 23:33:41 UTC 2020 on sn-devel-184
(cherry picked from commit
ad236bb7590e423b4c69fe6028f2f3495977f48b)
Karolin Seeger [Tue, 28 Jan 2020 10:13:25 +0000 (11:13 +0100)]
VERSION: Bump version up to 4.11.7...
and re-enable GIT_SNAPSHOT.
Signed-off-by: Karolin Seeger <kseeger@samba.org>
Karolin Seeger [Tue, 28 Jan 2020 10:09:48 +0000 (11:09 +0100)]
VERSION: Disable GIT_SNAPSHOT for the 4.11.6 release.
Signed-off-by: Karolin Seeger <kseeger@samba.org>
Karolin Seeger [Tue, 28 Jan 2020 10:08:58 +0000 (11:08 +0100)]
WHATSNEW: Add release notes for Samba 4.11.6.
Signed-off-by: Karolin Seeger <kseeger@samba.org>
Volker Lendecke [Wed, 31 Jul 2019 08:42:24 +0000 (10:42 +0200)]
smbd: Fix the build with clang
clang correctly complains that "close_fsp" is used uninitialized if
"get_posix_fsp" fails and we end up in "goto out;".
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14251
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit
a8a1ca3f83dce6d725392989cbc97271cbf52f4a)
Autobuild-User(v4-11-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-11-test): Mon Jan 27 10:53:50 UTC 2020 on sn-devel-184
Stefan Metzmacher [Tue, 21 Jan 2020 18:25:00 +0000 (19:25 +0100)]
script/release.sh: make it possible to run from a git worktree
.git is a regular file in that case.
Also check that script/release.sh is present as a relative path
to ensure we're called from the expected location.
Signed-off-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit
648f94d2031c6e758bdf54089d1e710c265ca732)
Karolin Seeger [Tue, 21 Jan 2020 10:02:17 +0000 (11:02 +0100)]
VERSION: Bump version up to 4.11.6.
Signed-off-by: Karolin Seeger <kseeger@samba.org>
Karolin Seeger [Tue, 21 Jan 2020 10:01:42 +0000 (11:01 +0100)]
Merge tag 'samba-4.11.5' into v4-11-test
samba: tag release samba-4.11.5
Andreas Schneider [Mon, 25 Nov 2019 10:11:13 +0000 (11:11 +0100)]
libsmbclient: If over SMB1 first try to do a posix stat on the file.
Disable in future, if server doesn't support this.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14101
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Thu Dec 19 15:44:25 UTC 2019 on sn-devel-184
(cherry picked from commit
8b04590e4d8f817ad6d194bb9d622c18734e3011)
Autobuild-User(v4-11-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-11-test): Wed Jan 15 10:33:14 UTC 2020 on sn-devel-184
Andreas Schneider [Mon, 25 Nov 2019 10:10:49 +0000 (11:10 +0100)]
s3:libsmb: Add a setup_stat_from_stat_ex() function
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14101
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit
b3e3cb3bbd86a53b48ee009adf811d48dd50dc8b)
Andreas Schneider [Mon, 25 Nov 2019 10:09:52 +0000 (11:09 +0100)]
s3:libsmb: Return a 'struct stat' buffer for SMBC_getatr()
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14101
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit
0fe9dc5219beaf605da9c7922053f7324507b50e)
Andreas Schneider [Mon, 25 Nov 2019 10:06:57 +0000 (11:06 +0100)]
s3:libsmb: Add try_posixinfo to SMBSRV struct. Only enable for SMB1 with UNIX for now.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14101
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit
bf9a3a7aa1913238ae2c997ce00369d0dbae3a08)
Andreas Schneider [Wed, 18 Dec 2019 12:27:26 +0000 (13:27 +0100)]
s3:libsmb: Generate the inode only based on the path component
Currently we use the full smb url which includes also username and
password.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14101
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit
ea51a426e506bd6456814ecddcb63441859f9d89)
Jeremy Allison [Fri, 18 Oct 2019 17:48:55 +0000 (10:48 -0700)]
s3: libsmb: Move setting all struct stat fields into setup_stat().
That way we only have one place where a struct stat is synthesised
for libsmbclient callers.
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit
1f0715c0e5e6ff371e3b393a0b35222c8b6f49bc)
Jeremy Allison [Fri, 18 Oct 2019 16:34:02 +0000 (09:34 -0700)]
s3: libsmb: Move setting st->st_ino into setup_stat.
Signed-off-by: Puran Chand <pchand@vmware.com>
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit
7d3b4f47be0359b496087fc40f89b815c7958dd6)
Jeremy Allison [Fri, 18 Oct 2019 16:24:38 +0000 (09:24 -0700)]
s3: libsmb: Change generate_inode()/setup_stat() to modern coding standards.
Change setup_stat() to be void. It doesn't return anything. Export
so it can be used by upcoming smbc_readdirplus2() call.
Remove unused SMBCCTX *context parameters.
Remove unused talloc_stackframe().
Signed-off-by: Puran Chand <pchand@vmware.com>
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit
d44a84295b46cc6c540a9730a615a59c1f22a277)
Martin Schwenke [Thu, 28 Nov 2019 03:00:58 +0000 (14:00 +1100)]
ctdb-tests: Skip some tests that don't work with IPv6
See the comments added to the tests.
It may be possible to rewrite these so they do something sane for
IPv6... some other time.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14227
RN: Fix IPv6 issues (NFS connection tracking, tests)
Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
Autobuild-User(master): Amitay Isaacs <amitay@samba.org>
Autobuild-Date(master): Fri Jan 3 00:00:55 UTC 2020 on sn-devel-184
(backported from commit
9edf15afc219a1a782ec1e4d29909361bbabc744)
Signed-off-by: Martin Schwenke <martin@meltin.net>
Autobuild-User(v4-11-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-11-test): Tue Jan 14 10:28:01 UTC 2020 on sn-devel-184
Karolin Seeger [Wed, 8 Jan 2020 10:55:21 +0000 (11:55 +0100)]
VERSION: Disable GIT_SNAPSHOT for the 4.11.5 release.
o CVE-2019-14902: Replication of ACLs set to inherit down a subtree on AD
Directory not automatic.
o CVE-2019-14907: Crash after failed character conversion at log level 3 or
above.
o CVE-2019-19344: Use after free during DNS zone scavenging in Samba AD DC.
Signed-off-by: Karolin Seeger <kseeger@samba.org>
Karolin Seeger [Wed, 8 Jan 2020 10:53:55 +0000 (11:53 +0100)]
WHATSNEW: Add release notes for Samba 4.11.5.
o CVE-2019-14902: Replication of ACLs set to inherit down a subtree on AD
Directory not automatic.
o CVE-2019-14907: Crash after failed character conversion at log level 3 or
above.
o CVE-2019-19344: Use after free during DNS zone scavenging in Samba AD DC.
Signed-off-by: Karolin Seeger <kseeger@samba.org>
Martin Schwenke [Fri, 13 Dec 2019 00:09:04 +0000 (11:09 +1100)]
ctdb-scripts: Strip square brackets when gathering connection info
ss added square brackets around IPv6 addresses in versions > 4.12.0
via commit
aba9c23a6e1cb134840c998df14888dca469a485. CentOS 7 added
this feature somewhere mid-release. So, backward compatibility is
obviously needed.
As per the comment protocol/protocol_util.c should probably print and
parse such square brackets. However, for backward compatibility the
brackets would have to be stripped in both places in
update_tickles()... or added to the ss output when missing. Best to
leave this until we have a connection tracking daemon.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14227
Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
(cherry picked from commit
693080abe4d8bec96280af5a6aa668251a98ec5d)
Andreas Schneider [Mon, 16 Dec 2019 14:50:17 +0000 (15:50 +0100)]
librpc: Fix string length checking in ndr_pull_charset_to_null()
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14219
Pair-Programmed-With: Guenther Deschner <gd@samba.org>
Signed-off-by: Guenther Deschner <gd@samba.org>
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit
f11e207e01c52566c47e350ff240fe95392de0c3)
Fabrice Fontaine [Mon, 16 Dec 2019 09:28:53 +0000 (10:28 +0100)]
source4/utils/oLschema2ldif: include stdint.h before cmocka.h
This fix the following build failure:
In file included from /home/fabrice/buildroot/output/host/opt/ext-toolchain/lib/gcc/mips64el-buildroot-linux-uclibc/5.5.0/include/stdint.h:9:0,
from /home/fabrice/buildroot/output/host/mips64el-buildroot-linux-uclibc/sysroot/usr/include/inttypes.h:27,
from ../../lib/replace/../replace/replace.h:64,
from ../../source4/include/includes.h:23,
from ../../source4/utils/oLschema2ldif/test.c:25:
/home/fabrice/buildroot/output/host/mips64el-buildroot-linux-uclibc/sysroot/usr/include/stdint.h:122:27: error: conflicting types for ‘uintptr_t’
typedef unsigned long int uintptr_t;
^
In file included from ../../source4/utils/oLschema2ldif/test.c:23:0:
/home/fabrice/buildroot/output/host/mips64el-buildroot-linux-uclibc/sysroot/usr/include/cmocka.h:132:28: note: previous declaration of ‘uintptr_t’ was here
typedef unsigned int uintptr_t;
Fixes:
- http://autobuild.buildroot.org/results/
9507739b3d5d51024ee9c60b74c2f85d5004e7e2
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14218
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Reviewed-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Wed Dec 18 16:57:52 UTC 2019 on sn-devel-184
(cherry picked from commit
1bfb384018deb2ee5c27dbea9fa2cdd98901fdcc)
Fabrice Fontaine [Sun, 15 Dec 2019 16:08:24 +0000 (17:08 +0100)]
lib/ldb/tests: include stdint.h before cmocka.h
This fix the following build failures:
[2466/3864] Linking bin/default/lib/ldb/ldbmodify
In file included from /home/buildroot/autobuild/instance-0/output-1/host/opt/ext-toolchain/lib/gcc/mips64el-buildroot-linux-uclibc/5.5.0/include/stdint.h:9:0,
from ../../lib/tevent/tevent.h:31,
from ../../lib/ldb/include/ldb.h:51,
from ../../lib/ldb/tests/test_ldb_dn.c:25:
/home/buildroot/autobuild/instance-0/output-1/host/mips64el-buildroot-linux-uclibc/sysroot/usr/include/stdint.h:122:27: error: conflicting types for 'uintptr_t'
typedef unsigned long int uintptr_t;
^
In file included from ../../lib/ldb/tests/test_ldb_dn.c:23:0:
/home/buildroot/autobuild/instance-0/output-1/host/mips64el-buildroot-linux-uclibc/sysroot/usr/include/cmocka.h:132:28: note: previous declaration of 'uintptr_t' was here
typedef unsigned int uintptr_t;
^
In file included from /home/buildroot/autobuild/instance-0/output-1/host/opt/ext-toolchain/lib/gcc/mips64el-buildroot-linux-uclibc/5.5.0/include/stdint.h:9:0,
from ../../lib/tevent/tevent.h:31,
from ../../lib/ldb/tests/ldb_key_value_test.c:48:
/home/buildroot/autobuild/instance-0/output-1/host/mips64el-buildroot-linux-uclibc/sysroot/usr/include/stdint.h:122:27: error: conflicting types for 'uintptr_t'
typedef unsigned long int uintptr_t;
^
In file included from ../../lib/ldb/tests/ldb_key_value_test.c:43:0:
/home/buildroot/autobuild/instance-0/output-1/host/mips64el-buildroot-linux-uclibc/sysroot/usr/include/cmocka.h:132:28: note: previous declaration of 'uintptr_t' was here
typedef unsigned int uintptr_t;
^
Fixes:
- http://autobuild.buildroot.org/results/
9507739b3d5d51024ee9c60b74c2f85d5004e7e2
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14218
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Reviewed-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit
f8799bf076d647d73aa749f3864d022a366c3904)
David Disseldorp [Thu, 12 Dec 2019 21:14:50 +0000 (22:14 +0100)]
vfs_ceph_snapshots: fix root relative path handling
For file paths relative to root, ceph_snap_get_parent_path() may return
an empty parent dir string, in which case the CephFS snashot path should
be ".snap".
Bug: https://bugzilla.samba.org/show_bug.cgi?id=14216
Signed-off-by: David Disseldorp <ddiss@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit
54293f92cd83efc3a5a78fc29a85643921da9d32)
Gary Lockyer [Thu, 19 Dec 2019 03:31:46 +0000 (16:31 +1300)]
upgradedns: ensure lmdb lock files linked
Ensure that the '-lock' files for the dns partitions as well as the data
files are linked when running
samba_dnsupgrade --dns-backend=BIND9_DLZ
failure to create these links can cause corruption of the corresponding
data file.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14199
Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit
0bd479140c18ab79479ced4f25f366744c3afe18)
Gary Lockyer [Thu, 19 Dec 2019 03:31:24 +0000 (16:31 +1300)]
test upgradedns: ensure lmdb lock files linked
Add tests to check that the '-lock' files for the dns partitions as well as
the data files are linked when running
samba_dnsupgrade --dns-backend=BIND9_DLZ
failure to create these links can cause corruption of the corresponding
data file.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14199
Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit
f0cebbe4dd0317e2abfcbe252977383e6f37f3bd)
Björn Jacke [Tue, 7 Jan 2020 09:21:18 +0000 (10:21 +0100)]
docs-xml/winbindnssinfo: clarify interaction with idmap_ad etc.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14122
RN: docs: clarify interaction between winbind nss info and idmap backend
Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Wed Jan 8 15:37:46 UTC 2020 on sn-devel-184
(cherry picked from commit
55fbd4c05b477e95920b53b94eda2572e075e6e1)
Gary Lockyer [Mon, 16 Dec 2019 00:57:47 +0000 (13:57 +1300)]
CVE-2019-19344 kcc dns scavenging: Fix use after free in dns_tombstone_records_zone
ldb_msg_add_empty reallocates the underlying element array, leaving
old_el pointing to freed memory.
This patch takes two defensive copies of the ldb message, and performs
the updates on them rather than the ldb messages in the result.
Bug: https://bugzilla.samba.org/show_bug.cgi?id=14050
Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Andrew Bartlett [Fri, 29 Nov 2019 07:58:47 +0000 (20:58 +1300)]
CVE-2019-14907 lib/util: Do not print the failed to convert string into the logs
The string may be in another charset, or may be sensitive and
certainly may not be terminated. It is not safe to just print.
Found by Robert Święcki using a fuzzer he wrote for smbd.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14208
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Andrew Bartlett [Thu, 12 Dec 2019 01:44:57 +0000 (14:44 +1300)]
CVE-2019-14902 dsdb: Change basis of descriptor module deferred processing to be GUIDs
We can not process on the basis of a DN, as the DN may have changed in a rename,
not only that this module can see, but also from repl_meta_data below.
Therefore remove all the complex tree-based change processing, leaving only
a tree-based sort of the possible objects to be changed, and a single
stopped_dn variable containing the DN to stop processing below (after
a no-op change).
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12497
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Andrew Bartlett [Fri, 6 Dec 2019 05:26:42 +0000 (18:26 +1300)]
CVE-2019-14902 repl_meta_data: Set renamed = true (and so do SD inheritance) after any rename
Previously if there was a conflict, but the incoming object would still
win, this was not marked as a rename, and so inheritence was not done.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12497
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Andrew Bartlett [Tue, 26 Nov 2019 02:50:35 +0000 (15:50 +1300)]
CVE-2019-14902 repl_meta_data: Fix issue where inherited Security Descriptors were not replicated.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12497
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Andrew Bartlett [Fri, 6 Dec 2019 05:05:54 +0000 (18:05 +1300)]
CVE-2019-14902 repl_meta_data: schedule SD propagation to a renamed DN
We need to check the SD of the parent if we rename, it is not the same as an incoming SD change.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12497
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Andrew Bartlett [Fri, 6 Dec 2019 04:54:23 +0000 (17:54 +1300)]
CVE-2019-14902 dsdb: Ensure we honour both change->force_self and change->force_children
If we are renaming a DN we can be in a situation where we need to
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12497
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Andrew Bartlett [Tue, 26 Nov 2019 03:17:32 +0000 (16:17 +1300)]
CVE-2019-14902 dsdb: Add comments explaining why SD propagation needs to be done here
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12497
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Andrew Bartlett [Tue, 26 Nov 2019 02:44:32 +0000 (15:44 +1300)]
CVE-2019-14902 dsdb: Explain that descriptor_sd_propagation_recursive() is proctected by a transaction
This means we can trust the DB did not change between the two search
requests.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12497
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Andrew Bartlett [Sun, 15 Dec 2019 22:29:27 +0000 (11:29 +1300)]
selftest: Add test to confirm ACL inheritence really happens
While we have a seperate test (sec_descriptor.py) that confirms inheritance in
general we want to lock in these specific patterns as this test covers
rename.
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Andrew Bartlett [Tue, 10 Dec 2019 02:16:24 +0000 (15:16 +1300)]
CVE-2019-14902 selftest: Add test for a special case around replicated renames
It appears Samba is currently string-name based in the ACL inheritence code.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12497
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Andrew Bartlett [Thu, 28 Nov 2019 04:16:16 +0000 (17:16 +1300)]
CVE-2019-14902 selftest: Add test for replication of inherited security descriptors
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12497
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Karolin Seeger [Mon, 16 Dec 2019 14:54:00 +0000 (15:54 +0100)]
VERSION: Bump version up to 4.11.5...
and re-enable GIT_SNAPSHOT.
Signed-off-by: Karolin Seeger <kseeger@samba.org>
(cherry picked from commit
5a75d9814091631001be8d7d8ccec66ea6380cfb)
Anoop C S [Tue, 12 Nov 2019 14:28:43 +0000 (19:58 +0530)]
s3: VFS: glusterfs: Reset nlinks for symlink entries during readdir
On receiving an already initialized stat_ex buffer for readdir() call we
invoke readdirplus() GlusterFS API, an optimized variant of readdir(),
which then returns stat information along with dir entry result. But for
symlink entries we don't know if link or target info is needed. In that
case it is better to leave this decision back to caller by resetting
nlinks value inside stat information to make it invalid.
This was also preventing us from displaying msdfs link as directories
inside the share.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14182
Signed-off-by: Anoop C S <anoopcs@redhat.com>
Reviewed-by: Günther Deschner <gd@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Dec 17 21:53:07 UTC 2019 on sn-devel-184
(cherry picked from commit
fca2d3e0d1fa5af59e7b729f7c1d126f7b81e149)
Autobuild-User(v4-11-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-11-test): Thu Dec 19 09:52:17 UTC 2019 on sn-devel-184
Torsten Fohrer [Sun, 15 Dec 2019 15:58:40 +0000 (16:58 +0100)]
Avoiding bad call flags with python 3.8, using METH_NOARGS instead of zero.
(C) SBE network solutions GmbH
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14209
Signed-off-by: Torsten Fohrer <torsten.fohrer@sbe.de>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Wed Dec 18 14:33:58 UTC 2019 on sn-devel-184
(cherry picked from commit
f0eb1e623f76d3dbd0c22f96cabebd1041c147df)
Douglas Bagnall [Mon, 2 Dec 2019 22:17:26 +0000 (11:17 +1300)]
pygpo: use correct method flags
The METH_KEYWORDS argument must always be combined with METH_VARARGS.
In Python up to 3.7 this was checked at runtime, and as we had no callers to
get_unix_path() in Python we never noticed. In Python 3.8 it is checked at
import time, and everyone notices even if they aren't directly using GPOs.
Found and reported by Val Kulkov.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14209
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit
12cccf3447333dfd4f5e437cd57ca5ec68724fdd)
Karolin Seeger [Mon, 16 Dec 2019 14:54:00 +0000 (15:54 +0100)]
VERSION: Bump version up to 4.11.5...
and re-enable GIT_SNAPSHOT.
Signed-off-by: Karolin Seeger <kseeger@samba.org>
Karolin Seeger [Mon, 16 Dec 2019 14:53:05 +0000 (15:53 +0100)]
VERSION: Disable GIT_SNAPSHOT for the 4.11.4 release.
Signed-off-by: Karolin Seeger <kseeger@samba.org>
Jeremy Allison [Tue, 26 Nov 2019 20:53:09 +0000 (12:53 -0800)]
s3: smbd: Only set xconn->smb1.negprot.done = true after supported_protocols[protocol].proto_reply_fn() succeeds.
Otherwise we can end up with negprot.done set, but
without smbXsrv_connection_init_tables() being called.
This can cause a client self-crash.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14205
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Wed Dec 4 21:27:24 UTC 2019 on sn-devel-184
(cherry picked from commit
8db0c1bff6f42feabd2e4d9dfb13ae12cc29607b)
Autobuild-User(v4-11-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-11-test): Fri Dec 13 12:30:57 UTC 2019 on sn-devel-184
Jeremy Allison [Tue, 3 Dec 2019 01:23:21 +0000 (17:23 -0800)]
python: tests. Add test for fuzzing smbd crash bug.
Mark knownfail for now.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14205
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit
46899ecf836d350c0c29b615869851da7d0ad6fb)
Jeremy Allison [Tue, 26 Nov 2019 20:46:16 +0000 (12:46 -0800)]
s3: smbd: Ensure we exit if supported_protocols[protocol].proto_reply_fn() fails.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14205
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
(cherry picked from commit
e84910d919e02feab2a297fccbbf95f333e32119)
Jeremy Allison [Tue, 26 Nov 2019 20:43:25 +0000 (12:43 -0800)]
s3: smbd: Change (*proto_reply_fn()) to return an NTSTATUS.
That way the caller can know if the negprot really
succeeded or not.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14205
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
(cherry picked from commit
f4caa4159bd3db5127e114718e606867348a4f47)
Jeremy Allison [Tue, 26 Nov 2019 20:21:06 +0000 (12:21 -0800)]
s3: smbd: Change reply_smb20xx() to return NTSTATUS.
Not yet used.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14205
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
(cherry picked from commit
836219c479b047403d2b0839a6b92ad637dbaea0)
Jeremy Allison [Tue, 26 Nov 2019 20:17:29 +0000 (12:17 -0800)]
s3: smbd: Ensure we exit on smbd_smb2_process_negprot() fail.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14205
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
(cherry picked from commit
a2d81d77c111379cbb6bd732c717307974eace0a)
Jeremy Allison [Tue, 26 Nov 2019 20:14:29 +0000 (12:14 -0800)]
s3: smbd: Allow smbd_smb2_process_negprot() to return NTSTATUS as it can fail.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14205
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
(cherry picked from commit
868bc05cf5d575e20edcce241e3af1d0fa6d9824)
Jeremy Allison [Thu, 7 Nov 2019 20:02:13 +0000 (12:02 -0800)]
s3: smbd: SMB2 - Ensure we use the correct session_id if encrypting an interim response.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14189
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit
eae1a45d09ef54dd6b59803eedca672ae9433902)
Karolin Seeger [Tue, 10 Dec 2019 09:26:08 +0000 (10:26 +0100)]
VERSION: Bump version up to 4.11.4.
Signed-off-by: Karolin Seeger <kseeger@samba.org>
Karolin Seeger [Tue, 10 Dec 2019 09:25:47 +0000 (10:25 +0100)]
Merge tag 'samba-4.11.3' into v4-11-test
samba: tag release samba-4.11.3
Volker Lendecke [Tue, 9 Jul 2019 18:04:03 +0000 (20:04 +0200)]
smbd: Increase a debug level
This is not a real error, it happens when the share mode record is not
around.
Bug: https://bugzilla.samba.org/show_bug.cgi?id=14211
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
(cherry picked from commit
4b05fe7ca73dae30807680f0e0401340bfb2c738)
Autobuild-User(v4-11-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-11-test): Wed Dec 4 10:15:19 UTC 2019 on sn-devel-184
git.samba.org / samba.git / log