1
0
mirror of https://github.com/samba-team/samba.git synced 2025-01-11 05:18:09 +03:00
Commit Graph

30345 Commits

Author SHA1 Message Date
Jeremy Allison
0dc6181894 CVE-2013-4408:s3:Ensure LookupNames replies arrays are range checked.
Bug: https://bugzilla.samba.org/show_bug.cgi?id=10185

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Jeremy Allison <jra@samba.org>
2013-12-09 07:05:46 +01:00
Jeremy Allison
b0ba4a5621 CVE-2013-4408:s3:Ensure LookupSids replies arrays are range checked.
Bug: https://bugzilla.samba.org/show_bug.cgi?id=10185

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Jeremy Allison <jra@samba.org>
2013-12-09 07:05:46 +01:00
Stefan Metzmacher
127de4f4ac CVE-2013-4408:s4:dcerpc_sock: check for invalid frag_len within sock_complete_packet()
Bug: https://bugzilla.samba.org/show_bug.cgi?id=10185

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2013-12-09 07:05:45 +01:00
Stefan Metzmacher
77c3518152 CVE-2013-4408:s4:dcerpc_smb2: check for invalid frag_len in send_read_request_continue()
Bug: https://bugzilla.samba.org/show_bug.cgi?id=10185

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2013-12-09 07:05:45 +01:00
Stefan Metzmacher
3be7907fd9 CVE-2013-4408:s4:dcerpc_smb: check for invalid frag_len in send_read_request_continue()
Bug: https://bugzilla.samba.org/show_bug.cgi?id=10185

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2013-12-09 07:05:45 +01:00
Stefan Metzmacher
db5fff3bc9 CVE-2013-4408:s4:dcerpc: check for invalid frag_len in ncacn_pull()
Bug: https://bugzilla.samba.org/show_bug.cgi?id=10185

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2013-12-09 07:05:45 +01:00
Michael Adam
5173322007 s4:torture:smb2: add new durable-v2-open.reopen1a test
- open session1 on tcp connection conn1
- open a durable handle on a session1
- do a session reconnect on a new tcp connection conn2
- doing a durable reconnect on session1 gives
  USER_SESSION_DELETED
- doing a durable reconnect on session2 succeeds

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>

Autobuild-User(master): David Disseldorp <ddiss@samba.org>
Autobuild-Date(master): Fri Dec  6 15:59:15 CET 2013 on sn-devel-104
2013-12-06 15:59:15 +01:00
Michael Adam
a46059d534 s4:torture:smb2: add new durable-open.reopen1a test
- open session1 on tcp connection conn1
- open a durable handle on a session1
- do a session reconnect on a new tcp connection conn2
- doing a durable reconnect on session1 gives
  USER_SESSION_DELETED
- doing a durable reconnect on session2 succeeds

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>
2013-12-06 14:01:34 +01:00
Garming Sam
df9df74195 cldap: quieten error when abandon packet is sent
The specification indicates that no response needs to be sent when receiving
an abandon request packet.

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Jelmer Vernooij <jelmer@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Fri Dec  6 07:13:29 CET 2013 on sn-devel-104
2013-12-06 07:13:29 +01:00
Andreas Schneider
4f06c681b9 s4-torture: Use talloc for asprintf.
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2013-12-06 01:14:09 +01:00
Andreas Schneider
b871c3907a s4-torture: Fix out of bound array access.
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2013-12-06 01:14:09 +01:00
Andreas Schneider
34f498525c s3-torture: Comment out dead code in spoolss test.
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2013-12-06 01:14:09 +01:00
Andreas Schneider
3b3b52c013 s4-torture: Fix some compile warnings in spoolss.
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2013-12-06 01:14:09 +01:00
Andreas Schneider
09cc58c1a7 s4-torture: Make sure handles are correctly initialized.
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2013-12-06 01:14:09 +01:00
Andreas Schneider
ef2cd51586 s4-torture: Make sure the handles are initialized correctly.
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2013-12-06 01:14:09 +01:00
Andreas Schneider
13e33ab98e s4-torture: Make sure the handles are not used uninitialized.
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2013-12-06 01:14:09 +01:00
Andreas Schneider
9d53d9f7e5 s4-libcli: Add smb2_util_handle_empty().
Will be used in the next commit.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2013-12-06 01:14:09 +01:00
David Disseldorp
5be0995d98 torture: match Windows responses to bad shadow copy IDs
test_fsrvp_bad_id() issues DeleteShareMapping requests with invalid
shadow copy IDs, expect Windows Server 2012 return codes.

Signed-off-by: David Disseldorp <ddiss@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2013-12-06 01:14:09 +01:00
David Disseldorp
dbb6f07728 torture: test duplicate shares in FSRVP shadow-copy set
MS-FSRVP 3.1.4.4 documents the requirement for failure when duplicate
volume names are encountered on AddToShadowCopySet.

Signed-off-by: David Disseldorp <ddiss@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2013-12-06 01:14:09 +01:00
Jeremy Allison
48f426b22d smbtorture: New torture test for bug #9870.
Not fetching the latest modification time on a folder if we have read locks on it.

Prove we should just rely on the mtime value from the underlying
filesystem, even with an open handle.

  BUG: https://bugzilla.samba.org/show_bug.cgi?id=9870

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Thu Dec  5 10:05:06 CET 2013 on sn-devel-104
2013-12-05 10:05:06 +01:00
David Disseldorp
549b70eb43 torture: enum snapshots after FSRVP creation
Issue an SMB2 ENUM_SNAPSHOTS ioctl following FSRVP snapshot creation to
cover Explorer previous file version use-cases.

This test will fail against Windows Server 2012, as FSRVP created
snapshots are not exposed via the ENUM_SNAPSHOTS ioctl.

Signed-off-by: David Disseldorp <ddiss@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2013-12-05 00:48:33 +01:00
Amitay Isaacs
bdb818d9b4 s4-rpc: dnsserver: Ignore duplicate dns zones from multiple locations
Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Kai Blin <kai@samba.org>

Autobuild-User(master): Amitay Isaacs <amitay@samba.org>
Autobuild-Date(master): Sat Nov 30 06:15:52 CET 2013 on sn-devel-104
2013-11-30 06:15:51 +01:00
Amitay Isaacs
97dd673157 s4-dns: Ignore duplicate dns zones from multiple locations in dlz_bind9
BIND DLZ module currently loads DNS zones from DNS partitions and domain
partitions using following prefixes:

   CN=MicrosoftDNS,DC=DomainDnsZones
   CN=MicrosoftDNS,DC=ForestDNSZones
   CN=MicrosoftDNS,CN=System

Windows supports DNS zones duplicated in DNS partitions and domain
partition and updates both of them simultaneously.

BIND DLZ module can handle DNS zones stored either in DNS partitions
or domain partition, but not both.  This patch ignores duplicate zones
from domain partition and allows BIND9 to work with AD with duplicate
DNS zones.

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Kai Blin <kai@samba.org>
2013-11-30 14:22:57 +11:00
Jelmer Vernooij
92489bfed4 Cope with first element in hdb_method having a different name in different heimdal versions.
It's called `interface_version` in older Heimdal versions and
`version` in newer versions.

Signed-off-by: Jelmer Vernooij <jelmer@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Thu Nov 28 04:17:55 CET 2013 on sn-devel-104
2013-11-28 04:17:55 +01:00
Jelmer Vernooij
a0eac12d5a Use heim_octet_string typedef.
The struct version is not provided by newer versions of heimdal.

Signed-off-by: Jelmer Vernooij <jelmer@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-11-28 02:25:55 +01:00
Jelmer Vernooij
ac27e88502 Remove no longer used et_deps.pl.
Signed-off-by: Jelmer Vernooij <jelmer@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-11-28 02:25:55 +01:00
Jelmer Vernooij
09e6a5e156 Remove no longer used asn1_deps.pl.
Signed-off-by: Jelmer Vernooij <jelmer@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-11-28 02:25:55 +01:00
David Disseldorp
cb353a34dd torture: test get/set compression ioctl permissions
Windows Server 2012[r2] exhibits some strange behaviour with regard
to handling the compression fsctls.
[READ/WRITE]_ATTR permissions are not required for the corresponding
get/set compression ioctls. WRITE_DATA is required for set compression.

Signed-off-by: David Disseldorp <ddiss@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Fri Nov 22 19:57:48 CET 2013 on sn-devel-104
2013-11-22 19:57:48 +01:00
David Disseldorp
aa197c18c4 torture: split open from test_setup_create_fill
Signed-off-by: David Disseldorp <ddiss@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2013-11-22 08:56:45 -08:00
David Disseldorp
2b435ad4b4 torture: attempt to set compression via SetInfo
Doing so should give a successful SetInfo response, however the
attribute should not be set in subsequent GetInfo / ioctl responses.

Signed-off-by: David Disseldorp <ddiss@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2013-11-22 08:56:45 -08:00
David Disseldorp
7dd05f55a8 torture: test dir non-inherit in compress_inherit_disable
Also add a note reguarding Windows 2008GM copy-chunk note:
Windows 2008GM (non-R2) fails the copy-chunk src=dest overlap test, as
it appears to use a different chunk copy algorithm to 208R2.
Takeaway advice is to avoid using copy-chunk when the source and
destination ranges overlap in the same file.

Signed-off-by: David Disseldorp <ddiss@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2013-11-22 08:56:45 -08:00
Andrew Bartlett
e665fc3940 lib/param: Consolidate code to enable smb signing on the server, always enable on AD DC
This uses the code from the source4/ SMB server (the NTVFS smb server)
in common, to force SMB Signing to be on when we are an AD DC.

Andrew Bartlett

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>

Autobuild-User(master): David Disseldorp <ddiss@samba.org>
Autobuild-Date(master): Fri Nov 22 13:13:05 CET 2013 on sn-devel-104
2013-11-22 13:13:03 +01:00
Arvid Requate
addabf1513 torture: test printing using "XPS_PASS" datatype
The "XPS_PASS" datatype is used by Windows 8.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=10267

Reviewed-by: David Disseldorp <ddiss@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Thu Nov 21 15:01:30 CET 2013 on sn-devel-104
2013-11-21 15:01:30 +01:00
Günther Deschner
6a0b75f901 docs: remove duplicate mention of "smbtorture" in smbtorture manpage.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2013-11-19 09:52:39 +01:00
Günther Deschner
e320d57ed6 docs: remove duplicate arguments listing in regdiff manpage.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2013-11-19 09:52:39 +01:00
Volker Lendecke
0d5f217cfe heimdal: Fix CID 745516 Use after free
If the loop is exited normally, i.e. we did not find anything proper
within DH_NUM_TRIES, we try to BN_free a second time.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>

Autobuild-User(master): David Disseldorp <ddiss@samba.org>
Autobuild-Date(master): Thu Nov 14 19:17:06 CET 2013 on sn-devel-104
2013-11-14 19:17:06 +01:00
Michael Adam
1c9c2e3b65 s4:rpc-server: fix lsa_lookupsids return value for the domain sid
We currently return type UNKNOWN and copy the domain sid to the name.
Instead we should return type DOMAIN and return NULL as name.

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Wed Nov 13 13:34:16 CET 2013 on sn-devel-104
2013-11-13 13:34:16 +01:00
Michael Adam
29d8edfe43 s4:rpc-server: fix use after free in dcesrv_lsa_lookup_sid()
Authority name may be accessed after
state has gone away and take domain_name with it.

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2013-11-13 11:40:28 +01:00
Volker Lendecke
55b3d87036 heimdal: Fix CID 240779 Allocation size mismatch
The error Coverity complains about is in the malloc. krb5_enctypes is
an enum, so it is usually smaller than the size of a pointer. So we
overallocate, but in the memcpy further down we copy from potentially
invalid memory.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Wed Nov 13 11:05:44 CET 2013 on sn-devel-104
2013-11-13 11:05:44 +01:00
Volker Lendecke
91b04f708f tls: Fix CID 242014 Uninitialized scalar variable
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2013-11-13 09:01:55 +01:00
Volker Lendecke
2be1eeab7f tls: Fix some noblank line endings
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2013-11-13 09:01:55 +01:00
Volker Lendecke
2e6862e9c5 heimdal: Fix CID 241943 Uninitialized pointer read
In the error case without EXTRA_ADDRESSES we access ignore_addresses
without initialization

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2013-11-13 09:01:55 +01:00
Andreas Schneider
744abc8822 s4-dsdb: Fix a use after free segfault.
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>

Autobuild-User(master): David Disseldorp <ddiss@samba.org>
Autobuild-Date(master): Tue Nov 12 19:22:28 CET 2013 on sn-devel-104
2013-11-12 19:22:28 +01:00
Andreas Schneider
4cf8f10500 s4-torture: Relax time checking in CHECK_NTTIME.
NTTIME has a nanosecond resolution. We should be tolerate if the system
is busy writing and reading the value. To reproduce this problem just
run the test under valgrind.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>
2013-11-12 17:33:12 +01:00
Benjamin Franzke
0dd512eead s4:torture/netlogon: Test netlogon with additional attrs
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Nadezhda Ivanova <nivanova@symas.com>

se enter the commit message for your changes. Lines starting

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Tue Nov 12 00:57:19 CET 2013 on sn-devel-104
2013-11-12 00:57:19 +01:00
Benjamin Franzke
767bd6a4d4 s4:torture/ldap: Add test for netlogon over tcp
This patch moves the udp netlogon tests from cldap.c
to netlogon.c and passes a generic netlogon-send
function as parameter.

Therefore a tcp replacement for cldap_netlogon is also added.
The two variants tcp and udp are added as 2 new torture tests:

ldap.netlogon-udp & ldap.netlogon-tcp
Both tests succeed.

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Nadezhda Ivanova <nivanova@symas.com>
2013-11-11 23:00:55 +01:00
Benjamin Franzke
68ebb09193 s4:dsdb: Move cldap netlogon functions into samdb/ldb_modules
As netlogon is handled by the samdb now,
the corresponding functions should live there as well.

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Nadezhda Ivanova <nivanova@symas.com>
2013-11-11 23:00:54 +01:00
Benjamin Franzke
7106dcf2b8 s4:cldap_server: Do not handle netlogon ourself anymore
Netlogon is now handled by the ldb rootdse module.

The netlogon files will be moved to dsdb in the next commit.

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Nadezhda Ivanova <nivanova@symas.com>
2013-11-11 23:00:54 +01:00
Benjamin Franzke
0620c79d76 s4:dsdb/rootdse: Support netlogon request
This patch adds support for a netlogon ldap style request
over the tcp socket.  This is available since win2k3+ [1].

The automatic client join & configuration daemon "realmd" makes
use of this ability.
Realmd can now be used to join a computer to a samba 4 domain.
(See also:
https://lists.samba.org/archive/samba-technical/2013-October/095606.html)

Tested with:
ldapsearch -h samba-srv -x -b '' -s base "(&(NtVer=\06\00\00\00)(AAC=\00\00\00\00))" NetLogon

And compared the result in wireshark with cldap request issued by
examples/misc/cldap.pl.

[1]: http://wiki.wireshark.org/MS-CLDAP?action=recall&rev=8

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Nadezhda Ivanova <nivanova@symas.com>
2013-11-11 23:00:54 +01:00
Benjamin Franzke
7a5a62547b s4:dsdb/rootdse: Pass rootdse context to rootdse_add_dynamic
This replaced the *module parameter, and uses ac->module in the function
instead, same for *req and *attrs.

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Nadezhda Ivanova <nivanova@symas.com>
2013-11-11 23:00:54 +01:00