Jule Anger [Wed, 19 Jan 2022 15:01:47 +0000 (16:01 +0100)]
VERSION: Disable GIT_SNAPSHOT for the 4.15.4 release.
Signed-off-by: Jule Anger <janger@samba.org>
Jule Anger [Wed, 19 Jan 2022 15:01:20 +0000 (16:01 +0100)]
WHATSNEW: Add release notes for Samba 4.15.4.
Signed-off-by: Jule Anger <janger@samba.org>
Stefan Metzmacher [Fri, 17 Dec 2021 22:32:28 +0000 (23:32 +0100)]
auth/ntlmssp: make sure we return INVALID_PARAMETER for NTLMv2_RESPONSE parsing errors
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14932
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Jan 4 20:57:41 UTC 2022 on sn-devel-184
(cherry picked from commit
dd9886100514941aa16af8566faf41501b601a44)
Autobuild-User(v4-15-test): Jule Anger <janger@samba.org>
Autobuild-Date(v4-15-test): Tue Jan 18 20:22:14 UTC 2022 on sn-devel-184
Stefan Metzmacher [Fri, 17 Dec 2021 22:23:33 +0000 (23:23 +0100)]
s4:torture/smb2: add smb2.session.ntlmssp_bug14932 test
This demonstrates that an invalid av_pair in NTLMv2_CLIENT_CHALLENGE
should result in NT_STATUS_INVALID_PARAMETER at the NTLMSSP layer.
This is different from the netr_LogonSamLogon*() case, where it is
ignored instead.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14932
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit
e0b705d26f0b151ba52d1f9f5504f622fadf7d7c)
Stefan Metzmacher [Wed, 15 Dec 2021 16:25:06 +0000 (17:25 +0100)]
libcli/auth: let NTLMv2_RESPONSE_verify_netlogon_creds ignore invalid netapp requests
We should avoid spamming the logs with wellknown messages like:
ndr_pull_error(Buffer Size Error): Pull bytes 39016
They just confuse admins (and developers).
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14932
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit
23bedd69b2db0dd6de98ed147eddcba799694de7)
Stefan Metzmacher [Wed, 15 Dec 2021 16:25:06 +0000 (17:25 +0100)]
libcli/auth: let NTLMv2_RESPONSE_verify_netlogon_creds ignore BUFFER_TOO_SMALL
Windows doesn't complain about invalid av_pair blobs,
we need to do the same.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14932
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit
f123c1a171e59113feb688523b499dab0b824528)
Stefan Metzmacher [Fri, 17 Dec 2021 21:28:51 +0000 (22:28 +0100)]
s4:torture/rpc: add test for invalid av_pair content in LogonSamLogonEx
A netapp diag tool uses a NTLMv2_CLIENT_CHALLENGE with invalid bytes
as av_pair blob. Which is supposed to be ignored by DCs.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14932
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit
e7e521fe9b947e553e2bf093e93f1d66ae9c95b9)
Stefan Metzmacher [Sat, 18 Dec 2021 09:40:36 +0000 (10:40 +0100)]
auth/credentials: cli_credentials_set_ntlm_response() pass session_keys
Otherwise cli_credentials_get_ntlm_response() will return session keys
with a 0 length, which leads to errors in the NTLMSSP code.
This wasn't noticed as cli_credentials_set_ntlm_response() has no
callers yet, but that will change in the next commits.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14932
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit
0ef1254f4428ab83ab6c8ca5e3415a1a9e069c92)
Andreas Schneider [Thu, 13 Jan 2022 14:31:33 +0000 (15:31 +0100)]
s3:smbd: handle --build-options without parsing smb.conf
The smb.conf is parsed in post mode of a popt callback. The smbd
--build-options parameter should be handled when first encountered
to avoid requiring smb.conf presence.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14945
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>
(cherry picked from commit
6a463c40d755b75b02884f123c19cc2c2845d729)
Autobuild-User(v4-15-test): Jule Anger <janger@samba.org>
Autobuild-Date(v4-15-test): Tue Jan 18 18:42:28 UTC 2022 on sn-devel-184
Stefan Metzmacher [Tue, 21 Dec 2021 10:19:40 +0000 (11:19 +0100)]
s3:libsmb: fix signing regression SMBC_server_internal()
commit
d0062d312cbbf80afd78143ca5c0be68f2d72b03 introduced
SMBC_ENCRYPTLEVEL_DEFAULT as default, but the logic to enforce
signing wasn't adjusted, so we required smb signing by default.
That broke guest authentication for libsmbclient using applications.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14935
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Mon Dec 27 16:38:11 UTC 2021 on sn-devel-184
(cherry picked from commit
9d2bf015378c5bc630c92618e034c5eba95cc6b4)
Stefan Metzmacher [Tue, 21 Dec 2021 11:05:13 +0000 (12:05 +0100)]
s4:selftest: run libsmbclient.noanon_list against maptoguest
This demonstrates the problem with guest access being rejected
by default.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14935
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit
0a808f6b53f50f426bd706f5327f610bb9e5967d)
Stefan Metzmacher [Tue, 21 Dec 2021 11:04:30 +0000 (12:04 +0100)]
s4:torture/libsmbclient: add libsmbclient.noanon_list test
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14935
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit
59e436297b0a4baa01e4e8a4bbb9c0bc9d7e1f29)
Stefan Metzmacher [Tue, 21 Dec 2021 13:39:25 +0000 (14:39 +0100)]
selftest/Samba3: enable SMB1 for maptoguest
guest authentication is an old school concept,
so we should make sure it also works with SMB1.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14935
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit
648b476dcdb6f378b627266cb787fd8f38fba56a)
Jeremy Allison [Wed, 12 Jan 2022 18:42:48 +0000 (10:42 -0800)]
s3: smbd: Add missing pop_sec_ctx() in error code path of close_directory()
If delete_all_streams() fails.
Found by Andrew Walker <awalker@ixsystems.com>
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14944
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Christof Schmitt <cs@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Fri Jan 14 03:34:47 UTC 2022 on sn-devel-184
(cherry picked from commit
5f9dbf3decd17129f360cbe14383cc79e20fb70b)
Autobuild-User(v4-15-test): Jule Anger <janger@samba.org>
Autobuild-Date(v4-15-test): Mon Jan 17 10:21:10 UTC 2022 on sn-devel-184
Volker Lendecke [Thu, 23 Dec 2021 10:52:38 +0000 (11:52 +0100)]
ctdb-protocol: Allow rfc5952 "[2001:db8::1]:80" ipv6 notation
Bug: https://bugzilla.samba.org/show_bug.cgi?id=14934
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Martin Schwenke <martin@meltin.net>
(cherry picked from commit
224e99804efef960ef4ce2ff2f4f6dced1e74146)
Pavel Filipenský [Fri, 7 Jan 2022 20:18:59 +0000 (21:18 +0100)]
s3:smbd: Fix dereferencing null pointer "fsp"
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14942
Remove fsp which is always NULL and replace it with smb_fname->fsp.
Found by covscan.
Signed-off-by: Pavel Filipenský <pfilipen@redhat.com>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit
46460025175e83fbb47a510e412d83b1b2573db9)
Autobuild-User(v4-15-test): Jule Anger <janger@samba.org>
Autobuild-Date(v4-15-test): Wed Jan 12 14:27:00 UTC 2022 on sn-devel-184
Pavel Filipenský [Fri, 7 Jan 2022 12:55:38 +0000 (13:55 +0100)]
s3:modules: VFS CAP symlinkat always fails
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14941
Found by covscan.
Since capnew is initialized by NULL, checking it too early makes the
rest of the function a dead code.
Pair-programmed-with: Andreas Schneider <asn@samba.org>
Signed-off-by: Pavel Filipenský <pfilipen@redhat.com>
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit
41ebb7f68c5b21492f503afc4cb341a97654a43d)
Autobuild-User(v4-15-test): Jule Anger <janger@samba.org>
Autobuild-Date(v4-15-test): Wed Jan 12 12:43:05 UTC 2022 on sn-devel-184
Pavel Filipenský [Fri, 7 Jan 2022 12:16:26 +0000 (13:16 +0100)]
s3:modules: Fix the horrible vfs_crossrename module
It really has to be removed! ;-)
Found by covscan. The code always leaves here as the dst variable
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14940
Pair-programmed-with: Andreas Schneider <asn@samba.org>
Signed-off-by: Pavel Filipenský <pfilipen@redhat.com>
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit
4d7ed39fd8fa18f90756f215c8b0fc5d293e955e)
Jeremy Allison [Tue, 4 Jan 2022 00:52:25 +0000 (16:52 -0800)]
s3: smbclient: In do_host_query(), if we need SMB1, ensure we select NT1 as the client max protocol" before continuing.
Remove knownfail: selftest/knownfail.d/list_servers
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14939
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Noel Power <noel.power@suse.com>
Autobuild-User(master): Noel Power <npower@samba.org>
Autobuild-Date(master): Thu Jan 6 11:50:32 UTC 2022 on sn-devel-184
(cherry picked from commit
099c62a654da2623653218c771dd8fabdc7cc091)
Jeremy Allison [Tue, 4 Jan 2022 00:48:17 +0000 (16:48 -0800)]
s3: selftest: Add two tests that show we try and send an SMB1 request over an SMB2 connection to list servers if "-mSMB3" is selected.
Add knownfail: knownfail.d/list_servers
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14939
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Noel Power <npower@samba.org>
(cherry picked from commit
0d9d1546a7bad6e0fac58e146a75e4eb1ce78c11)
Jones Syue [Mon, 10 Jan 2022 17:29:44 +0000 (09:29 -0800)]
s3: includes: Make the comments describing itime consistent. Always use "invented" time.
It gets confusing if we call it "imaginary" or "instantiation"
in different places.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14928
Signed-off-by: Jones Syue <jonessyue@qnap.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Mon Jan 10 18:42:02 UTC 2022 on sn-devel-184
(cherry picked from commit
745af26a1a6531b2e906aa7c1c0355cbab658441)
Jeremy Allison [Mon, 10 Jan 2022 17:01:09 +0000 (09:01 -0800)]
s3: lib: In create_clock_itime(), use timespec_current() -> clock_gettime(CLOCK_REALTIME..).
CLOCK_MONOTONIC (which we previously used) is reset
when the system is rebooted.
CLOCK_REALTIME is a "wall clock" time. It's still affected by NTP
changes (for Linux we should probably use CLOCK_TAI instead
but that is Linux-specific). For most systems CLOCK_REALTIME
will be good enough.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14928
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit
920611f0bc98229ac4a5ee127af7f99216075341)
Jeremy Allison [Wed, 5 Jan 2022 19:40:46 +0000 (11:40 -0800)]
s3: smbd: Create and use a common function for generating a fileid - create_clock_itime().
This first gets the clock_gettime_mono() value, converts to an NTTIME (as
this is what is stored in the dos attribute EA), then mixes in 8 bits of
randomness shifted up by 55 bits to cope with poor resolution clocks to
avoid duplicate inodes.
Using 8 bits of randomness on top of an NTTIME gives us around 114
years headroom. We can now guarentee returning a itime-based
fileid in a normal share (storing dos attributes in an EA).
Remove knownfail.d/fileid-unique
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14928
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Christof Schmitt <cs@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Sat Jan 8 06:35:22 UTC 2022 on sn-devel-184
(cherry picked from commit
23fbf0bad0332a0ae0d4dc3c8f6df6e7ec46b88b)
Jeremy Allison [Thu, 6 Jan 2022 21:58:20 +0000 (13:58 -0800)]
lib: util: Add a function nt_time_to_unix_timespec_raw().
Not yet used. Does no checks on the converted values.
A later cleanup will allow us to move nt_time_to_unix_timespec()
and nt_time_to_full_timespec() to use common code.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14928
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Christof Schmitt <cs@samba.org>
(cherry picked from commit
29d69c22a0d945193ce3dac27e1083dbc5c53f03)
Jeremy Allison [Thu, 6 Jan 2022 23:11:20 +0000 (15:11 -0800)]
tests: Add 2 tests for unique fileid's with top bit set (generated from itime) for files and directories.
smb2.fileid_unique.fileid_unique
smb2.fileid_unique.fileid_unique-dir
Create 100 files or directories as fast as we can
against a "normal" share, then read info on them
and ensure (a) top bit is set (generated from itime)
and (b) uniqueness across all generated objects
(checks poor timestamp resolution doesn't create
duplicate fileids).
This shows that even on ext4, this is enough to
cause duplicate fileids to be returned.
Add knownfail.d/fileid-unique
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14928
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Christof Schmitt <cs@samba.org>
(cherry picked from commit
30fea0d31117c1a899cd333a9b8a62ba765dbb02)
Jule Anger [Wed, 8 Dec 2021 14:33:39 +0000 (15:33 +0100)]
VERSION: Bump version up to Samba 4.15.4...
and re-enable GIT_SNAPSHOT.
Signed-off-by: Jule Anger <janger@samba.org>
Jule Anger [Wed, 8 Dec 2021 14:32:49 +0000 (15:32 +0100)]
VERSION: Disable GIT_SNAPSHOT for the 4.15.3 release.
Signed-off-by: Jule Anger <janger@samba.org>
Jule Anger [Wed, 8 Dec 2021 14:32:09 +0000 (15:32 +0100)]
WHATSNEW: Add release notes for Samba 4.15.3.
Signed-off-by: Jule Anger <janger@samba.org>
Ralph Boehme [Fri, 26 Nov 2021 10:59:45 +0000 (11:59 +0100)]
smbd: s3-dsgetdcname: handle num_ips == 0
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14923
Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Ralph Boehme <slow@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Fri Dec 3 12:54:04 UTC 2021 on sn-devel-184
(cherry picked from commit
5e3df5f9ee64a80898f73585b19113354f463c44)
Autobuild-User(v4-15-test): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(v4-15-test): Wed Dec 8 10:46:08 UTC 2021 on sn-devel-184
Andreas Schneider [Thu, 18 Nov 2021 12:46:26 +0000 (13:46 +0100)]
libcli:auth: Allow to connect to netlogon server offering only AES
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14912
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Thu Dec 2 14:49:35 UTC 2021 on sn-devel-184
(cherry picked from commit
d1ea9c5aaba42447f25a15935a9bf5bbd20f7d93)
Günther Deschner [Thu, 18 Nov 2021 10:52:18 +0000 (11:52 +0100)]
s3:rpc_client: Pass remote name and socket to cli_rpc_pipe_open_schannel_with_creds()
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14767
Pair-Programmed-With: Andreas Schneider <asn@samba.org>
Signed-off-by: Guenther Deschner <gd@samba.org>
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit
6bf3a39b11832ad2feb655e29da84f8b5aac298e)
Andreas Schneider [Thu, 18 Nov 2021 10:47:26 +0000 (11:47 +0100)]
s3:rpc_client: Add remote name and socket to cli_rpc_pipe_open_bind_schannel()
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14767
Pair-Programmed-With: Andreas Schneider <asn@samba.org>
Signed-off-by: Guenther Deschner <gd@samba.org>
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit
62aa769667464451cda672fc073e52a8e52ae4c1)
Günther Deschner [Thu, 18 Nov 2021 10:43:08 +0000 (11:43 +0100)]
s3:rpc_client: Pass remote name and socket to cli_rpc_pipe_open_with_creds()
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14767
Pair-Programmed-With: Andreas Schneider <asn@samba.org>
Signed-off-by: Andreas Schneider <asn@samba.org>
Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit
c7ead1292852da371ff53fcdbd7ebd4bc1c08fbd)
Andreas Schneider [Wed, 24 Nov 2021 12:21:28 +0000 (13:21 +0100)]
s3:libsmb: Remove trailing white spaces from passchange.c
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit
be1520d2058a9430cf370f6fefd07bbddf3fbfe0)
Günther Deschner [Thu, 18 Nov 2021 10:31:00 +0000 (11:31 +0100)]
s3:rpc_client: Pass remote name and socket to cli_rpc_pipe_open_noauth_transport()
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14767
Pair-Programmed-With: Andreas Schneider <asn@samba.org>
Signed-off-by: Guenther Deschner <gd@samba.org>
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit
bb3e0ce8fc932f5146044c548730f454a0119800)
Andreas Schneider [Thu, 18 Nov 2021 10:38:42 +0000 (11:38 +0100)]
s3:libnet: Remove tailing whitespaces in libnet_join.c
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14767
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit
34c57ebee04bb770174fab31edd9bfe2f88a84eb)
Andreas Schneider [Thu, 18 Nov 2021 10:32:42 +0000 (11:32 +0100)]
s3:rpcclient: Remove trailing white spaces in rpcclient.c
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14767
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit
33eb7a1bc9c21463dc699d6daaa6a1e19f668268)
Günther Deschner [Thu, 18 Nov 2021 10:18:59 +0000 (11:18 +0100)]
s3:rpc_client: Pass remote name and socket to cli_rpc_pipe_open()
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14767
Pair-Programmed-With: Andreas Schneider <asn@samba.org>
Signed-off-by: Guenther Deschner <gd@samba.org>
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit
016429acaf76bde53bd4ab81b48be23c2bcc28e3)
Andreas Schneider [Thu, 18 Nov 2021 10:14:16 +0000 (11:14 +0100)]
s3:rpc_client: Remove trailing white spaces from cli_pipe.c
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14767
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit
b3bf5bbaf81de369c8f9415d903816a2d7424ffc)
Andreas Schneider [Wed, 17 Nov 2021 10:46:04 +0000 (11:46 +0100)]
testprogs: Add rpcclient schannel tests
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14767
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit
492fd5b00fe9d62f53b96e3a7588a7f2848a571d)
Andrew Bartlett [Thu, 11 Nov 2021 23:44:44 +0000 (12:44 +1300)]
dsdb: Use DSDB_SEARCH_SHOW_EXTENDED_DN when searching for the local replicated object
This may allow further processing when the DN normalisation has changed
which changes the indexing, such as seen after fixes for bug 14656.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14656
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14902
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit
f621317e3b25a8925ab6e448068264488a0a47c7)
Ralph Boehme [Fri, 26 Nov 2021 09:57:17 +0000 (10:57 +0100)]
CVE-2020-25717: s3-auth: fix MIT Realm regression
This looks like a regression introduced by the recent security fixes. This
commit should hopefully fixes it.
As a quick solution it might be possible to use the username map script based on
the example in https://bugzilla.samba.org/show_bug.cgi?id=14901#c0. We're not
sure this behaves identical, but it might work in the standalone server case.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14922
Reported-at: https://lists.samba.org/archive/samba/2021-November/238720.html
Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Ralph Boehme <slow@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit
1e61de8306604a0d3858342df8a1d2412d8d418b)
Stefan Metzmacher [Wed, 15 Sep 2021 17:29:40 +0000 (19:29 +0200)]
smb2_server: skip tcon check and chdir_current_service() for FSCTL_QUERY_NETWORK_INTERFACE_INFO
We should not fail this just because the user doesn't have
permissions on the share root.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14788
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Wed Dec 1 11:51:50 UTC 2021 on sn-devel-184
(cherry picked from commit
f4d0bb164f028da46eab766135bb38175c117deb)
Autobuild-User(v4-15-test): Jule Anger <janger@samba.org>
Autobuild-Date(v4-15-test): Mon Dec 6 11:36:01 UTC 2021 on sn-devel-184
Stefan Metzmacher [Mon, 29 Nov 2021 18:56:20 +0000 (19:56 +0100)]
s4:torture/smb2: FSCTL_QUERY_NETWORK_INTERFACE_INFO should work on noperm share
Demonstrate that smbd fails FSCTL_QUERY_NETWORK_INTERFACE_INFO
only because the user doesn't have permissions on the share root.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14788
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit
629d161b8f579bc24acfaf3fe02612a5237345b4)
Stefan Metzmacher [Wed, 15 Sep 2021 18:27:12 +0000 (20:27 +0200)]
smb2_server: don't let SMB2_OP_IOCTL force FILE_CLOSED for invalid file ids
smbd_smb2_request_process_ioctl() already detailed checks for file_ids,
which not reached before.
.allow_invalid_fileid = true was only used for SMB2_OP_IOCTL.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14788
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit
1744dd8c5bc342a74e397951506468636275fe45)
Stefan Metzmacher [Mon, 29 Nov 2021 18:56:20 +0000 (19:56 +0100)]
s4:torture/smb2: FSCTL_QUERY_NETWORK_INTERFACE_INFO gives INVALID_PARAMETER with invalid file ids
An invalid file id for FSCTL_QUERY_NETWORK_INTERFACE_INFO gives
INVALID_PARAMETER instead of FILE_CLOSED.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14788
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit
fb33f145ff598b03a08098b7f12f3c53491f6c04)
Stefan Metzmacher [Wed, 15 Sep 2021 18:26:58 +0000 (20:26 +0200)]
smb2_ioctl: return BUFFER_TOO_SMALL in smbd_smb2_request_ioctl_done()
We should not send more data than the client requested.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14788
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit
aab540503434817cc6b2de1d9c507f9d0b3ad980)
Stefan Metzmacher [Mon, 29 Nov 2021 18:44:12 +0000 (19:44 +0100)]
s4:torture/smb2: test FSCTL_QUERY_NETWORK_INTERFACE_INFO with BUFFER_TOO_SMALL
It seems that we currently don't have BUFFER_TOO_SMALL handling
for FSCTL/IOCTL calls.
FSCTL_QUERY_NETWORK_INTERFACE_INFO is just an easy example
to demonstrate it.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14788
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit
b3212b359edb78d4c60fed377fa18478c8e75d9a)
Stefan Metzmacher [Mon, 16 Aug 2021 15:28:05 +0000 (17:28 +0200)]
smb2_server: skip tcon check and chdir_current_service() for FSCTL_VALIDATE_NEGOTIATE_INFO
We should not fail this just because the user doesn't have permissions
on the share root.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14788
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit
c850ce96fd32ea91d8a31223bb09dd5b8b98d99e)
Stefan Metzmacher [Wed, 15 Sep 2021 15:25:53 +0000 (17:25 +0200)]
smb2_server: decouple IOCTL check from signing/encryption states
There's no reason to handle FSCTL_SMBTORTURE_FORCE_UNACKED_TIMEOUT
differently if signing/encryption is used.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14788
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit
bd3ba3c96e6ba811afd5898ff5470188557a6e33)
Stefan Metzmacher [Wed, 15 Sep 2021 15:22:39 +0000 (17:22 +0200)]
smb2_server: make sure in_ctl_code = IVAL(body, 0x04); reads valid bytes
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14788
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit
1cd948d8520fd41a4e2f0cc6ee787c1e20211e33)
Stefan Metzmacher [Wed, 15 Sep 2021 16:31:06 +0000 (18:31 +0200)]
s4:torture/smb2: add smb2.ioctl.bug14788.VALIDATE_NEGOTIATE
Demonstrate that smbd fails FSCTL_VALIDATE_NEGOTIATE_INFO
only because the user doesn't have permissions on the share root.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14788
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit
735fc34682c541056fd912d07c69f299f961983c)
Stefan Metzmacher [Thu, 16 Sep 2021 08:51:43 +0000 (10:51 +0200)]
libcli/smb: split out smb2cli_raw_tcon* from smb2cli_tcon*
This will be used in tests in order to separate the tcon from
validate_negotiate_info.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14788
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit
04a79139a42cfd1b607317dec041618cbf629584)
Andreas Schneider [Tue, 23 Nov 2021 14:48:57 +0000 (15:48 +0100)]
s3:winbind: Fix possible NULL pointer dereference
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14921
BUG: https://bugzilla.redhat.com/show_bug.cgi?id=
2019888
Signed-off-by: Andreas Schneider <asn@samba.org>
Rewiewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit
cbf312f02bc86f9325fb89f6f5441bc61fd3974f)
Autobuild-User(v4-15-test): Jule Anger <janger@samba.org>
Autobuild-Date(v4-15-test): Thu Dec 2 11:38:42 UTC 2021 on sn-devel-184
Andrew Bartlett [Thu, 18 Nov 2021 03:09:47 +0000 (16:09 +1300)]
CVE-2021-3670 ldap_server: Clearly log LDAP queries and timeouts
This puts all the detail on one line so it can be searched
by IP address and connecting SID.
This relies on the anr handling as otherwise this log
becomes the expanded query, not the original one.
RN: Provide clear logs of the LDAP search and who made it, including
a warning (at log level 3) for queries that are 1/4 of the hard timeout.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14694
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org>
Autobuild-Date(master): Thu Nov 25 02:30:42 UTC 2021 on sn-devel-184
(cherry picked from commit
3507e96b3dcf0c0b8eff7b2c08ffccaf0812a393)
Andrew Bartlett [Thu, 18 Nov 2021 02:57:34 +0000 (15:57 +1300)]
CVE-2021-3670 dsdb/anr: Do a copy of the potentially anr query before starting to modify it
RN: Do not modify the caller-supplied memory in the anr=* handling to
allow clear logging of the actual caller request after it has been processed.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14694
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
(cherry picked from commit
5f0590362c5c0c5ee20503a67467f9be2d50e73b)
Andrew Bartlett [Thu, 18 Nov 2021 02:27:08 +0000 (15:27 +1300)]
CVE-2021-3670 ldap_server: Remove duplicate print of LDAP search details
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14694
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
(cherry picked from commit
2b3af3b560c9617a233c131376c870fce146c002)
Andrew Bartlett [Mon, 27 Sep 2021 03:47:46 +0000 (16:47 +1300)]
CVE-2021-3670 ldb: Confirm the request has not yet timed out in ldb filter processing
The LDB filter processing is where the time is spent in the LDB stack
but the timeout event will not get run while this is ongoing, so we
must confirm we have not yet timed out manually.
RN: Ensure that the LDB request has not timed out during filter processing
as the LDAP server MaxQueryDuration is otherwise not honoured.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14694
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
(cherry picked from commit
1d5b155619bc532c46932965b215bd73a920e56f)
Joseph Sutton [Tue, 28 Sep 2021 04:20:43 +0000 (17:20 +1300)]
CVE-2021-3670 ldap_server: Ensure value of MaxQueryDuration is greater than zero
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14694
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
(cherry picked from commit
e1ab0c43629686d1d2c0b0b2bcdc90057a792049)
Joseph Sutton [Thu, 26 Aug 2021 01:53:23 +0000 (13:53 +1200)]
CVE-2021-3670 ldap_server: Set timeout on requests based on MaxQueryDuration
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14694
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
(cherry picked from commit
86fe9d48883f87c928bf31ccbd275db420386803)
Joseph Sutton [Thu, 26 Aug 2021 09:18:26 +0000 (21:18 +1200)]
CVE-2021-3670 tests/krb5/test_ldap.py: Add test for LDAP timeouts
We allow a timeout of 2x over to avoid this being a flapping test.
Samba is not very accurate on the timeout, which is not otherwise an
issue but makes this test fail sometimes.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14694
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
(cherry picked from commit
dcfcafdbf756e12d9077ad7920eea25478c29f81)
Volker Lendecke [Wed, 17 Nov 2021 11:27:27 +0000 (12:27 +0100)]
cmdline: Make -P work in clustered mode
Bug: https://bugzilla.samba.org/show_bug.cgi?id=14908
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Wed Nov 17 18:29:09 UTC 2021 on sn-devel-184
(cherry picked from commit
cdc0268c1987f36ab400ea01df88d55c02dccfdb)
Autobuild-User(v4-15-test): Jule Anger <janger@samba.org>
Autobuild-Date(v4-15-test): Fri Nov 19 08:11:05 UTC 2021 on sn-devel-184
Volker Lendecke [Wed, 17 Nov 2021 11:25:58 +0000 (12:25 +0100)]
cmdline: Add a callback to set the machine account details
source3 clients need to work in clustered mode, the default
cli_credentials_set_machine_account() only looks at the local
secrets.tdb file
Bug: https://bugzilla.samba.org/show_bug.cgi?id=14908
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit
63c80f25da8829a7bd3244afea29c13f699efac1)
Volker Lendecke [Wed, 17 Nov 2021 11:25:05 +0000 (12:25 +0100)]
lib: Add required includes to source3/include/secrets.h
Bug: https://bugzilla.samba.org/show_bug.cgi?id=14908
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit
d6270525699fbc856b217cf18ece7f1d063b144d)
Volker Lendecke [Wed, 17 Nov 2021 15:34:07 +0000 (16:34 +0100)]
selftest: Add reproducer for bug 14908
Bug: https://bugzilla.samba.org/show_bug.cgi?id=14908
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit
9faa3173193ddcb95905993d960cc10d4366524e)
Andrew Walker [Thu, 28 Oct 2021 20:01:42 +0000 (16:01 -0400)]
s3:modules:recycle - fix crash in recycle_unlink_internal
Original logic for separating path from base name assumed
that we were using same string to determine offset when
getting the parent dir name (smb_fname->base_name).
Simplify by using parent_dirname() to split the path
from base name.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14888
Signed-off-by: Andrew Walker <awalker@ixsystems.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Sat Oct 30 04:34:53 UTC 2021 on sn-devel-184
(cherry picked from commit
be3a47e22ad6be204f4a7d6070f82f990c17e6fb)
Andrew Bartlett [Fri, 12 Nov 2021 03:10:31 +0000 (16:10 +1300)]
CVE-2020-25717: s3:auth: Fallback to a SID/UID based mapping if the named based lookup fails
Before the CVE-2020-25717 fixes we had a fallback from
getpwnam('DOMAIN\user') to getpwnam('user') which was very dangerous and
unpredictable.
Now we do the fallback based on sid_to_uid() followed by
getpwuid() on the returned uid.
This obsoletes 'username map [script]' based workaround adviced
for CVE-2020-25717, when nss_winbindd is not used or
idmap_nss is actually used.
In future we may decide to prefer or only do the SID/UID based
lookup, but for now we want to keep this unchanged as much as possible.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14901
Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
[metze@samba.org moved the new logic into the fallback codepath only
in order to avoid behavior changes as much as possible]
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Mon Nov 15 19:01:56 UTC 2021 on sn-devel-184
(cherry picked from commit
0a546be05295a7e4a552f9f4f0c74aeb2e9a0d6e)
Autobuild-User(v4-15-test): Jule Anger <janger@samba.org>
Autobuild-Date(v4-15-test): Wed Nov 17 16:12:28 UTC 2021 on sn-devel-184
Joseph Sutton [Fri, 12 Nov 2021 01:22:47 +0000 (14:22 +1300)]
CVE-2020-25717: tests/krb5: Add a test for idmap_nss mapping users to SIDs
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14901
Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
[metze@samba.org removed unused tests for a feature that
was removed before merging]
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit
494bf7de6ff3e9abeb3753df0635737b80ce5bb7)
Joseph Sutton [Fri, 12 Nov 2021 01:20:45 +0000 (14:20 +1300)]
CVE-2020-25717: selftest: turn ad_member_no_nss_wb into ad_member_idmap_nss
In reality environments without 'nss_winbind' make use of 'idmap_nss'.
For testing, DOMAIN/bob is mapped to the local 'bob',
while DOMAIN/jane gets the uid based on the local 'jane'
vis idmap_nss.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14901
Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
[metze@samba.org avoid to create a new ad_member_idmap_nss environment
and merge it with ad_member_no_nss_wb instead]
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit
8a9f2aa2c1cdfa72ad50d7c4f879220fe37654cd)
Joseph Sutton [Fri, 12 Nov 2021 07:53:30 +0000 (20:53 +1300)]
CVE-2020-25717: nsswitch/nsstest.c: Lower 'non existent uid' to make room for new accounts
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14901
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit
fdbee5e074ebd76d659613b8b7114d70f938c38a)
Joseph Sutton [Fri, 12 Nov 2021 01:14:55 +0000 (14:14 +1300)]
CVE-2020-25717: tests/krb5: Add method to automatically obtain server credentials
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14901
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit
5ea347d3673e35891613c90ca837d1ce4833c1b0)
Stefan Metzmacher [Fri, 12 Nov 2021 14:27:58 +0000 (15:27 +0100)]
CVE-2020-25727: idmap_nss: verify that the name of the sid belongs to the configured domain
We already check the sid belongs to the domain, but checking the name
too feels better and make it easier to understand.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14901
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit
bfd093648b4af51d104096c0cb3535e8706671e5)
Jeremy Allison [Thu, 4 Nov 2021 02:02:36 +0000 (19:02 -0700)]
s3: smbd: Ensure in the directory scanning loops inside rmdir_internals() we don't overwrite the 'ret' variable.
If we overwrite with ret=0, we return NT_STATUS_OK even when we goto err.
This function should be restructured to use NT_STATUS internally,
and make 'int ret' transitory, but that's a patch for another
time.
Remove knownfail.
BUG: BUG: https://bugzilla.samba.org/show_bug.cgi?id=14892
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Thu Nov 4 09:10:27 UTC 2021 on sn-devel-184
(cherry picked from commit
141f3f5f9a5ef556cc7864b2afbf8ad48b7ebe77)
Jeremy Allison [Wed, 3 Nov 2021 23:50:10 +0000 (16:50 -0700)]
s3: smbtorture3: Add test for setting delete on close on a directory, then creating a file within to see if delete succeeds.
Exposes an existing problem where "ret" is overwritten
in the directory scan.
Add knownfail.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14892
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit
adfad6390962022277cc6aacaa388af86e46b71c)
Jeremy Allison [Tue, 2 Nov 2021 17:44:44 +0000 (10:44 -0700)]
s3: smbd: dirfsp is being used uninitialized inside rmdir_internals().
Not caught be the tests in bugs 14878, 14879 as can_delete_directory_fsp()
doesn't have the same bug.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14892
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Wed Nov 3 14:33:49 UTC 2021 on sn-devel-184
(cherry picked from commit
bbdcd66c048fee39629aeff450b50d049806e2f7)
Ralph Boehme [Mon, 15 Nov 2021 17:04:30 +0000 (18:04 +0100)]
smbd: get rid of get_file_handle_for_metadata()
This also avoids triggering an assert in get_share_mode_lock(). We already have
a handle, use that one, no need to call get_file_handle_for_metadata().
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14907
RN: set_ea_dos_attribute() fallback calling get_file_handle_for_metadata() triggers locking.tdb assert
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Nov 16 18:51:15 UTC 2021 on sn-devel-184
(cherry picked from commit
a8c0c2c9e3adc94843a236fd9374980e2c0e6bfe)
Ralph Boehme [Mon, 8 Nov 2021 11:09:43 +0000 (12:09 +0100)]
lib/cmdline: setup default file logging for servers
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897
RN: samba process doesn't log to logfile
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Thu Nov 11 14:42:13 UTC 2021 on sn-devel-184
(cherry picked from commit
06ed4ccba6cfe08aef061866f98b1d1da26682b8)
Autobuild-User(v4-15-test): Jule Anger <janger@samba.org>
Autobuild-Date(v4-15-test): Tue Nov 16 16:56:19 UTC 2021 on sn-devel-184
Ralph Boehme [Mon, 8 Nov 2021 11:09:16 +0000 (12:09 +0100)]
lib/cmdline: remember config_type in samba_cmdline_init()
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit
97592f16bfb8590efbd2ed31fc9883d747ec650f)
Ralph Boehme [Mon, 8 Nov 2021 11:08:47 +0000 (12:08 +0100)]
lib/cmdline: fix indentation
s/whitespace/tab/
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit
120a598e53173aacc0994318223bdac33dac4fbd)
Ralph Boehme [Mon, 8 Nov 2021 18:41:50 +0000 (19:41 +0100)]
lib/debug: in debug_set_logfile() call reopen_logs_internal()
This simplifies the logging API for callers that typically would want to set
logging by just setup_logging() once without bothering that typically
configuration is loaded (via some lpcfg_load*() or lp_load*() varient) which
will only then pick up the configured logfile from smb.conf without actually
applying the new logifle to the logging subsytem.
Therefor our daemons will additionally call reopen_logs() explicitly in their
startup code after config is loaded, eg
setup_logging(getprogname(), DEBUG_FILE);
...
lpcfg_load(lp_ctx, config_file);
...
reopen_logs();
By calling reopen_logs_internal() implicitly from debug_set_logfile() there's no
need to call reopen_logs() explicitly anymore to apply the logfile.
As reopen_logs() will also apply other logging configuration options, we have to
keep the explicit calls in the daemon code. But at least this allows consistent
logging setup wrt to the logfile in the new cmdline library.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit
fa9d9974d068897d35539e5316f606a15e8b38de)
Ralph Boehme [Wed, 10 Nov 2021 13:13:11 +0000 (14:13 +0100)]
lib/debug: fix fd check before dup'ing to stderr
Before I added per-class logfile and we had only one fd for the logfile the code
looked like this:
/* Take over stderr to catch output into logs */
if (state.fd > 0) {
if (dup2(state.fd, 2) == -1) {
/* Close stderr too, if dup2 can't point it -
at the logfile. There really isn't much
that can be done on such a fundamental
failure... */
close_low_fd(2);
}
}
In the current code the equivalent to state.fd is dbgc_config[DBGC_ALL].fd.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit
948a82bd2651e73e4e669a89dc77ba93abbb9b2f)
Ralph Boehme [Wed, 10 Nov 2021 17:27:08 +0000 (18:27 +0100)]
winbindd: remove is_default_dyn_LOGFILEBASE() logic
Handling of -l commandline parameter is already implemented by lib/cmdline/.
is_default_dyn_LOGFILEBASE() == true is the default case and this causes us to
temporarily overwrite the configured logfile with LOGFILEBASE/log.winbindd until
winbindd_reload_services_file() restores it.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit
117d45df47a1f3206bc38aaeaa11f2b327e43530)
Ralph Boehme [Thu, 11 Nov 2021 04:23:09 +0000 (05:23 +0100)]
samba-bgqd: fix startup and logging
Let samba-bgqd use the new POPT_COMMON_DAEMON infrastructure.
The calls to setup_logging() can safely be removed as this is already taken care
of by samba_cmdline_init().
To avoid a logfile basename of ".log" when using "%m", we add a call to
set_remote_machine_name().
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit
54f54fc2627acbf5fac5e1fa86ab9f743741f3c4)
Ralph Boehme [Wed, 10 Nov 2021 19:18:07 +0000 (20:18 +0100)]
source3: move lib/substitute.c functions out of proto.h
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit
25043ebb2e6f74592e802f78d327f844e615a442)
Alexander Bokovoy [Fri, 12 Nov 2021 17:06:01 +0000 (19:06 +0200)]
IPA DC: add missing checks
When introducing FreeIPA support, two places were forgotten:
- schannel gensec module needs to be aware of IPA DC
- _lsa_QueryInfoPolicy should treat IPA DC as PDC
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14903
Signed-off-by: Alexander Bokovoy <ab@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
Autobuild-User(master): Alexander Bokovoy <ab@samba.org>
Autobuild-Date(master): Sat Nov 13 07:01:26 UTC 2021 on sn-devel-184
(cherry picked from commit
c69b66f649c1d47a7367f7efe25b8df32369a3a5)
Autobuild-User(v4-15-test): Jule Anger <janger@samba.org>
Autobuild-Date(v4-15-test): Mon Nov 15 14:34:34 UTC 2021 on sn-devel-184
Andreas Schneider [Wed, 10 Nov 2021 11:06:51 +0000 (12:06 +0100)]
auth:creds: Guess the username first via getpwuid(my_id)
If we have a container, we often don't have USER or LOGNAME set.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14883
Tested-by: Anoop C S <anoopcs@samba.org>
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit
c28be4067463e582e378df402f812e510883d606)
Autobuild-User(v4-15-test): Jule Anger <janger@samba.org>
Autobuild-Date(v4-15-test): Mon Nov 15 11:34:06 UTC 2021 on sn-devel-184
Stefan Metzmacher [Tue, 9 Nov 2021 19:50:20 +0000 (20:50 +0100)]
s3:winbindd: fix "allow trusted domains = no" regression
add_trusted_domain() should only reject domains
based on is_allowed_domain(), which now also
checks "allow trusted domains = no", if we don't
have an explicit trust to the domain (SEC_CHAN_NULL).
We use at least SEC_CHAN_LOCAL for local domains like
BUILTIN.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14899
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Wed Nov 10 11:21:31 UTC 2021 on sn-devel-184
(cherry picked from commit
a7f6c60cb037b4bc9eee276236539b8282213935)
Autobuild-User(v4-15-test): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(v4-15-test): Wed Nov 10 23:29:45 UTC 2021 on sn-devel-184
Günther Deschner [Thu, 4 Nov 2021 21:22:44 +0000 (22:22 +0100)]
s3-winexe: Fix winexe core dump (use-after-free)
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14893
Guenther
Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Fri Nov 5 11:43:57 UTC 2021 on sn-devel-184
(cherry picked from commit
e9495d2ed28a26899dc3dd77bdfe56e284980218)
Autobuild-User(v4-15-test): Jule Anger <janger@samba.org>
Autobuild-Date(v4-15-test): Wed Nov 10 17:05:18 UTC 2021 on sn-devel-184
Ralph Boehme [Tue, 2 Nov 2021 04:34:59 +0000 (05:34 +0100)]
vfs_fruit: remove a fsp check from ad_fset()
This comes from times before we had pathref fsps. Back then if you wanted to
check if fsp->fh->fd contained a valid value != -1, you'd also first check that
the passed in fsp and fsp->fh are non NULL. With pathref fsps we don't need this
anymore.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14890
RN: Crash in vfs_fruit asking for fsp_get_io_fd() for an XATTR call
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit
50c550e1ad422a1220d0862a3f637e5fb774f288)
Ralph Boehme [Fri, 29 Oct 2021 20:03:42 +0000 (22:03 +0200)]
lib/dbwrap: reset deleted record to tdb_null
This allows the calling the following sequence of dbwrap functions:
dbwrap_delete_record(rec);
data = dbwrap_record_get_value(rec);
without triggering the assert rec->value_valid inside dbwrap_record_get_value().
Note that dbwrap_record_storev() continues to invalidate the record, so this
change somewhat blurs our semantics.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14882
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Nov 4 19:49:47 UTC 2021 on sn-devel-184
(cherry picked from commit
8082e2eb7e33c0993135791c03823886f5aa8496)
Ralph Boehme [Fri, 29 Oct 2021 04:27:38 +0000 (06:27 +0200)]
CI: add a test for bug 14882
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14882
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit
1fa006f1f71cce03d92e76efda3ff055aae4eb91)
Stefan Metzmacher [Mon, 5 Oct 2020 06:52:32 +0000 (08:52 +0200)]
s3/libsmb: check for global parametric option "libsmb:client_guid"
Useful in test.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14882
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit
c1470b120bb75ea73ba90dc83ab7efcbb733b1a7)
Jeremy Allison [Mon, 25 Oct 2021 19:42:02 +0000 (12:42 -0700)]
s3: docs-xml: Clarify the "delete veto files" paramter.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14879
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Fri Oct 29 14:57:14 UTC 2021 on sn-devel-184
(cherry picked from commit
0b818c6b77e972626d0b071bebcf4ce55619fb84)
Jeremy Allison [Mon, 25 Oct 2021 19:36:57 +0000 (12:36 -0700)]
s3: smbd: Fix logic in can_delete_directory_fsp() to cope with dangling symlinks.
Remove knownfail.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14879
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit
e9ef970eee5eca8ab3720279c54098e91d2dfda9)
Jeremy Allison [Mon, 25 Oct 2021 19:32:29 +0000 (12:32 -0700)]
s3: smbd: Fix logic in rmdir_internals() to cope with dangling symlinks.
Still need to add the same logic in can_delete_directory_fsp()
before we can delete the knownfail.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14879
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit
26fecad2e66e91a3913d88ee2e0889f266e91d89)
Jeremy Allison [Mon, 25 Oct 2021 19:21:37 +0000 (12:21 -0700)]
s3: smbd: Fix rmdir_internals() to do an early return if lp_delete_veto_files() is not set.
Fix the comments to match what the code actually does. The
exit at the end of the scan directory loop if we find a client
visible filename is a change in behavior, but the previous
behavior (not exist on visible filename, but delete it) was
a bug and in non-tested code. Now it's testd.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14879
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit
a37d16e7c55f85e3f2c9c8614755ea6307092d5f)
Jeremy Allison [Mon, 25 Oct 2021 19:02:43 +0000 (12:02 -0700)]
s3: VFS: xattr_tdb. Allow unlinkat to cope with dangling symlinks.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14879
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit
f254be19d6501a4f573843af97963e350a9ee2ed)
Jeremy Allison [Mon, 25 Oct 2021 19:01:58 +0000 (12:01 -0700)]
s3: VFS: streams_depot. Allow unlinkat to cope with dangling symlinks.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14879
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit
295d7d026babe3cd5123d0f53adcb16868907f05)
Jeremy Allison [Thu, 21 Oct 2021 23:37:27 +0000 (16:37 -0700)]
s3: smbd: Add two tests showing the ability to delete a directory containing a dangling symlink over SMB2 depends on "delete veto files" setting.
Add knownfail.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14879
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit
942123b95923f35a32df4196a072a3ed3468396a)
Jeremy Allison [Thu, 21 Oct 2021 23:18:24 +0000 (16:18 -0700)]
s3: smbd: Fix recursive directory delete of a directory containing veto file and msdfs links.
Remove knownfail.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14878
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit
73de1194c3c429ab93d722a852aa4f54213b112a)
git.samba.org / samba.git / log