1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-25 23:21:54 +03:00
Commit Graph

130828 Commits

Author SHA1 Message Date
Pavel Filipenský
da2c723266 s3:passdb: Zero secrets_domain_info1_password created via secrets_fetch()
Zero out these members of struct secrets_domain_info1_password:

DATA_BLOB cleartext_blob;
struct samr_Password nt_hash;
struct secrets_domain_info1_kerberos_key *keys;

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-08-26 07:59:32 +00:00
Pavel Filipenský
01c0ab191a s3:passdb: Zero local memory in secrets_domain_info_kerberos_keys()
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-08-26 07:59:32 +00:00
Pavel Filipenský
ebfc167233 s3:passdb: Zero local memory in secrets_fetch()
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-08-26 07:59:32 +00:00
Pavel Filipenský
28a3d5119a lib:krb5: Change memset() to BURN_PTR_SIZE()
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-08-26 07:59:32 +00:00
Pavel Filipenský
4b2df80e89 s3:afs: Zero memory for afs_keyfile
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-08-26 07:59:32 +00:00
Pavel Filipenský
83dc061fd3 s3:net: Zero password in secrets_fetch_ipc_userpass() callers
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-08-26 07:59:32 +00:00
Pavel Filipenský
2578eb3b5e s3:passdb: Fix possible memory leak in secrets_fetch_ipc_userpass()
If domain or username are empty strings (""), we need to free them.

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-08-26 07:59:32 +00:00
Pavel Filipenský
5b64751394 s3:passdb: Zero password in secrets_fetch_ipc_userpass()
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-08-26 07:59:32 +00:00
Pavel Filipenský
8941c748c7 s3:net: Fix trailing whitespace in net.c
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-08-26 07:59:32 +00:00
Pavel Filipenský
1772a05757 s3:passdb: Zero memory in pdb_set_pw_history()
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-08-26 07:59:32 +00:00
Pavel Filipenský
003854a4f5 s3:passdb: Zero memory in pdb_set_plaintext_passwd()
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-08-26 07:59:32 +00:00
Pavel Filipenský
12478c24b0 s3:passdb: s/BURN_PTR_SIZE/BURN_STR/ in samu_destroy()
This makes sure that strlen(user->plaintext_pw) is not called twice.

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-08-26 07:59:32 +00:00
Pavel Filipenský
ccae2a4ab5 s3:auth: Zero memory in sam_password_ok()
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-08-26 07:59:32 +00:00
Pavel Filipenský
035e2021fa s3:passdb: Zero memory for plaintext_pw from 'struct samu'
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-08-26 07:59:32 +00:00
Pavel Filipenský
02f667587c s3:passdb: Fix whitespaces in pdb_get_set.c
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-08-26 07:59:32 +00:00
Pavel Filipenský
3151e76054 s3:passdb: Zero password in fetch_ldap_pw() callers
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-08-26 07:59:32 +00:00
Pavel Filipenský
84d5e156ff s3:passdb: Zero password in fetch_ldap_pw()
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-08-26 07:59:32 +00:00
Pavel Filipenský
2357f6e21e s3:passdb: Fix trailing whitespaces in pdb_ldap.c
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-08-26 07:59:32 +00:00
Pavel Filipenský
2706fdae54 s3:lib: Fix trailing whitespaces in smbldap.c
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-08-26 07:59:32 +00:00
Pavel Filipenský
04d4bc5494 s3: Zero memory of idmap_fetch_secret() users
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-08-26 07:59:32 +00:00
Pavel Filipenský
0d7e34a63d s3:passdb: Zero password in secrets_{fetch,store}_trusted_domain_password()
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-08-26 07:59:32 +00:00
Pavel Filipenský
ad9044a17a s3:passdb: Zero memory using BURN_FREE_STR() in get_trust_pw_hash2()
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-08-26 07:59:32 +00:00
Pavel Filipenský
ca3c9fa0f3 s3:passdb: Zero memory using BURN_FREE_STR() in secrets_fetch_or_upgrade_domain_info()
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-08-26 07:59:32 +00:00
Pavel Filipenský
b6dde7d31b s3:passdb: Zero memory using BURN_FREE() in secrets_fetch_trust_account_password_legacy() and secrets_fetch_domain_info1_by_key()
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-08-26 07:59:32 +00:00
Pavel Filipenský
988077c336 s3:libsmb: Zero memory in trust_pw_change()
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-08-26 07:59:32 +00:00
Pavel Filipenský
4df98ed05d s3:libads: Zero memory in ads_change_trust_account_password()
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-08-26 07:59:32 +00:00
Pavel Filipenský
8de685741b lib:util: Zero memory in generate_random_machine_password()
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-08-26 07:59:32 +00:00
Pavel Filipenský
8564380346 lib:replace: Add macro BURN_STR() to zero memory of a string
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-08-26 07:59:32 +00:00
Pavel Filipenský
fa29eed681 lib:util: Add BURN_FREE() and BURN_FREE_STR()
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-08-26 07:59:32 +00:00
Pavel Filipenský
c9c120da11 s3:libsmb: Fix trailing whitespaces in trusts_util.c
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-08-26 07:59:32 +00:00
Pavel Filipenský
f641abfcb5 s3:libads: Fix trailing whitespaces in util.c
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-08-26 07:59:32 +00:00
Joseph Sutton
9fa6ab2233 s3:tests: Transfer test files into temporary directory
The presence of these two files is causing 'check-clean-tree' to fail.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Aug 25 17:56:31 UTC 2022 on sn-devel-184
2022-08-25 17:56:31 +00:00
Joseph Sutton
989aa441df s3:tests: Create test directory and file prior to revoking permissions
If 'chmod 0' is performed first, then we won't have the required
permissions for the subsequent 'mkdir' and 'touch', and they will fail.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Jeremy Allison <jra@samba.org>
2022-08-25 17:01:31 +00:00
Martin Schwenke
a0e0fde039 ctdb-tests: Avoid shellcheck warnings
Mostly

  SC2086: Double quote to prevent globbing and word splitting.

Use ctdb_onnode() where it simplifies code.  No behaviour changes
intended.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

Autobuild-User(master): Amitay Isaacs <amitay@samba.org>
Autobuild-Date(master): Thu Aug 25 16:15:45 UTC 2022 on sn-devel-184
2022-08-25 16:15:45 +00:00
Martin Schwenke
ff4935d180 ctdb-tests: Simplify IP address checking
Use a new function and wait_until() to simplify.

get_test_ip_mask_and_iface() not needed here because
select_test_node_and_ips() sets $test_ip, and neither $mask nor $iface
is used.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
2022-08-25 15:22:36 +00:00
Martin Schwenke
42aedc62e3 ctdb-tests: Fix typos
These lines are just wrong:

  try_command_on_node -v $test_node "ip addr show to ${test_node}"
  if -n "$out"; then

The 2nd variable referenced should be $test_ip.  The 2nd line causes
"-n: command not found" because it is missing [] test command
brackets.

Both typos would probably make the test pass unconditionally.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
2022-08-25 15:22:36 +00:00
Martin Schwenke
b88e7322d9 ctdb-tests: Reformat script using shfmt -w -p -i 0 -fn
Whitespace changes only.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
2022-08-25 15:22:36 +00:00
Joseph Sutton
f99fb9aa12 python:tests: Allocate OID range for testing to avoid collisions
sid_strings.py used the same OID range as ldap_schema.py, which
occasionally led to test failures when the same OID was generated twice.
Using a different range, and making use of the expected RID if we have
it, should reduce the likelihood of collisions.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Thu Aug 25 13:55:47 UTC 2022 on sn-devel-184
2022-08-25 13:55:47 +00:00
Joseph Sutton
672ec6135f schema_samba4.ldif: Allocate previously added OIDs
DSDB_CONTROL_FORCE_ALLOW_VALIDATED_DNS_HOSTNAME_SPN_WRITE_OID was added
to source4/dsdb/samdb/samdb.h in commit
c2ab1f4696.

DSDB_EXTENDED_SCHEMA_LOAD was added in commit
1fd4cdfafa.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-08-25 12:59:29 +00:00
Ralph Boehme
6d493a9d56 smbd: implement access checks for SMB2-GETINFO as per MS-SMB2 3.3.5.20.1
The spec lists the following as requiring special access:

- for requiring FILE_READ_ATTRIBUTES:

  FileBasicInformation
  FileAllInformation
  FileNetworkOpenInformation
  FileAttributeTagInformation

- for requiring FILE_READ_EA:

  FileFullEaInformation

All other infolevels are unrestricted.

We ignore the IPC related infolevels:

  FilePipeInformation
  FilePipeLocalInformation
  FilePipeRemoteInformation

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15153
RN: Missing SMB2-GETINFO access checks from MS-SMB2 3.3.5.20.1

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Tue Aug 23 12:54:08 UTC 2022 on sn-devel-184
2022-08-23 12:54:08 +00:00
Ralph Boehme
9b2d281571 smbtorture: check required access for SMB2-GETINFO
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15153

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-08-23 11:52:29 +00:00
Ralph Boehme
66e40690bd s4/libcli/smb2: avoid using smb2_composite_setpathinfo() in smb2_util_setatr()
smb2_composite_setpathinfo() uses SEC_FLAG_MAXIMUM_ALLOWED which can
have unwanted side effects like breaking oplocks if the effective access
includes [READ|WRITE]_DATA.

For changing the DOS attributes we only need SEC_FILE_WRITE_ATTRIBUTE. With this
change test_smb2_oplock_batch25() doesn't trigger an oplock break anymore.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15153

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-08-23 11:52:29 +00:00
Andreas Schneider
339e78f207 gitlab-ci: Add a shellcheck runner
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>

Autobuild-User(master): Pavel Filipensky <pfilipensky@samba.org>
Autobuild-Date(master): Mon Aug 22 21:30:09 UTC 2022 on sn-devel-184
2022-08-22 21:30:09 +00:00
Andreas Schneider
f12aa54ba0 testprogs: Fix shellcheck errors in upgradeprovision-oldrelease.sh
testprogs/blackbox/upgradeprovision-oldrelease.sh:134:103: error: Double
quote array expansions to avoid re-splitting elements. [SC2068]

testprogs/blackbox/upgradeprovision-oldrelease.sh:140:117: error: Double
quote array expansions to avoid re-splitting elements. [SC2068]

testprogs/blackbox/upgradeprovision-oldrelease.sh:145:105: error: Double
quote array expansions to avoid re-splitting elements. [SC2068]

testprogs/blackbox/upgradeprovision-oldrelease.sh:151:122: error: Double
quote array expansions to avoid re-splitting elements. [SC2068]

testprogs/blackbox/upgradeprovision-oldrelease.sh:156:110: error: Double
quote array expansions to avoid re-splitting elements. [SC2068]

testprogs/blackbox/upgradeprovision-oldrelease.sh:162:134: error: Double
quote array expansions to avoid re-splitting elements. [SC2068]

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
2022-08-22 20:35:36 +00:00
Andreas Schneider
c4ba21bc77 testprogs: Fix shellcheck errors in test_wintest.sh
testprogs/blackbox/test_wintest.sh:15:97: error: Double quote array
expansions to avoid re-splitting elements. [SC2068]

testprogs/blackbox/test_wintest.sh:40:31: error: Double quote array
expansions to avoid re-splitting elements. [SC2068]

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
2022-08-22 20:35:36 +00:00
Andreas Schneider
355f620653 testprogs: Fix shellcheck errors in test_weak_crypto_server.sh
testprogs/blackbox/test_weak_crypto_server.sh:59:65: error: Use braces
when expanding arrays, e.g. ${array[idx]} (or ${var}[.. to quiet).
[SC1087]

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
2022-08-22 20:35:36 +00:00
Andreas Schneider
cd24e2dfb7 testprogs: Fix shellchecks errors in test_pdbtest.sh
testprogs/blackbox/test_pdbtest.sh:61:53: error: Double quote array
expansions to avoid re-splitting elements. [SC2068]

testprogs/blackbox/test_pdbtest.sh:73:157: error: Double quote array
expansions to avoid re-splitting elements. [SC2068]

testprogs/blackbox/test_pdbtest.sh:76:79: error: Double quote array
expansions to avoid re-splitting elements. [SC2068]

testprogs/blackbox/test_pdbtest.sh:78:92: error: Double quote array
expansions to avoid re-splitting elements. [SC2068]

testprogs/blackbox/test_pdbtest.sh:80:79: error: Double quote array
expansions to avoid re-splitting elements. [SC2068]

testprogs/blackbox/test_pdbtest.sh:90:79: error: Double quote array
expansions to avoid re-splitting elements. [SC2068]

testprogs/blackbox/test_pdbtest.sh:92:75: error: Double quote array
expansions to avoid re-splitting elements. [SC2068]

testprogs/blackbox/test_pdbtest.sh:96:73: error: Double quote array
expansions to avoid re-splitting elements. [SC2068]

testprogs/blackbox/test_pdbtest.sh💯99: error: Double quote array
expansions to avoid re-splitting elements. [SC2068]

testprogs/blackbox/test_pdbtest.sh:104:89: error: Double quote array
expansions to avoid re-splitting elements. [SC2068]

testprogs/blackbox/test_pdbtest.sh:111:125: error: Double quote array
expansions to avoid re-splitting elements. [SC2068]

testprogs/blackbox/test_pdbtest.sh:115:70: error: Double quote array
expansions to avoid re-splitting elements. [SC2068]

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
2022-08-22 20:35:36 +00:00
Andreas Schneider
150cbc0f3a testprogs: Fix shellcheck errors in test_password_settings.sh
testprogs/blackbox/test_password_settings.sh:48:57: error: Double quote
array expansions to avoid re-splitting elements. [SC2068]

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
2022-08-22 20:35:36 +00:00
Andreas Schneider
d9ebb77c11 testprogs: Fix shellcheck errors in test_kpasswd_heimdal.sh
testprogs/blackbox/test_kpasswd_heimdal.sh:46:57: error: Double quote
array expansions to avoid re-splitting elements. [SC2068]

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
2022-08-22 20:35:36 +00:00
Andreas Schneider
1e4ea99e5f testprogs: Fix shellcheck errors in test_kinit_trusts_mit.sh
testprogs/blackbox/test_kinit_trusts_mit.sh:55:63: error: Double quote
array expansions to avoid re-splitting elements. [SC2068]

testprogs/blackbox/test_kinit_trusts_mit.sh:109:106: error: Double quote
array expansions to avoid re-splitting elements. [SC2068]

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
2022-08-22 20:35:36 +00:00