1
0
mirror of https://github.com/samba-team/samba.git synced 2025-03-01 04:58:35 +03:00

132135 Commits

Author SHA1 Message Date
Volker Lendecke
db25f0a07c smbd: Move bytes from r/w data to r/o text section
Even const arrays of const strings need to be relocated at startup time.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2023-01-10 00:28:37 +00:00
Volker Lendecke
e0fc84668b lib: Move 16 bytes to readonly .text segment
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2023-01-10 00:28:37 +00:00
Volker Lendecke
14f761ec7d lib: Remove unused smb_mkstemp prototype
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2023-01-10 00:28:37 +00:00
Volker Lendecke
7ee474d9fd lib: Move tab_depth() to reg_parse_prs.c
Wow, I did not know we still use prs_struct...

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2023-01-10 00:28:37 +00:00
Volker Lendecke
6907db5cf0 lib: Make map_share_mode_to_deny_mode() static to smbstatus
At some point in the future this might disappear, we should really not
show DOS share modes in smbstatus. Maybe this can't be changed though.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2023-01-10 00:28:37 +00:00
Volker Lendecke
158314e0b1 smbd: Make get_safe_[[SI]VAL|ptr] static to smb1_lanman.c
SMB1-specific, only used there.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2023-01-10 00:28:37 +00:00
Samuel Cabrero
56837f3d31 CVE-2022-38023 s3:rpc_server/netlogon: Avoid unnecessary loadparm_context allocations
After s3 and s4 rpc servers merge the loadparm_context is available in
the dcesrv_context structure.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15240

Signed-off-by: Samuel Cabrero <scabrero@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Mon Jan  9 15:17:14 UTC 2023 on sn-devel-184
2023-01-09 15:17:14 +00:00
Samuel Cabrero
02fba22b8c CVE-2022-38023 docs-xml/smbdotconf: The "server schannel require seal[:COMPUTERACCOUNT]" options are also honoured by s3 netlogon server.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15240

Signed-off-by: Samuel Cabrero <scabrero@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2023-01-09 14:23:36 +00:00
Samuel Cabrero
a0b97e2623 CVE-2022-38023 s3:rpc_server/netlogon: Check for global "server schannel require seal"
By default we'll now require schannel connections with privacy/sealing/encryption.

But we allow exceptions for specific computer/trust accounts.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15240

Signed-off-by: Samuel Cabrero <scabrero@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2023-01-09 14:23:36 +00:00
Samuel Cabrero
ca07f4340c CVE-2022-38023 s3:rpc_server/netlogon: make sure all _netr_LogonSamLogon*() calls go through dcesrv_netr_check_schannel()
Some checks are also required for _netr_LogonSamLogonEx().

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15240

Signed-off-by: Samuel Cabrero <scabrero@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2023-01-09 14:23:36 +00:00
Samuel Cabrero
25300d354c CVE-2022-38023 s3:rpc_server/netlogon: Use dcesrv_netr_creds_server_step_check()
After s3 and s4 rpc servers merge we can avoid duplicated code.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15240

Signed-off-by: Samuel Cabrero <scabrero@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2023-01-09 14:23:36 +00:00
Samuel Cabrero
121e7b0e39 CVE-2022-38023 s4:rpc_server/netlogon: Move schannel and credentials check functions to librpc
Will be used later by s3 netlogon server.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15240

Signed-off-by: Samuel Cabrero <scabrero@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2023-01-09 14:23:36 +00:00
Samuel Cabrero
d9e6b490db CVE-2022-38023 s4:rpc_server:wscript: Reformat following pycodestyle
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15240

Signed-off-by: Samuel Cabrero <scabrero@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2023-01-09 14:23:35 +00:00
Samuel Cabrero
3cd18690f8 CVE-2022-38023 selftest:Samba3: avoid global 'server schannel = auto'
Instead of using the generic deprecated option use the specific
server require schannel:COMPUTERACCOUNT = no in order to allow
legacy tests for pass.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15240

Signed-off-by: Samuel Cabrero <scabrero@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2023-01-09 14:23:35 +00:00
Samuel Cabrero
8141eae47a CVE-2022-38023 s3:rpc_server/netlogon: 'server schannel != yes' warning to dcesrv_interface_netlogon_bind
Follow s4 netlogon server changes and move the checks to the RPC bind
hook. Next commits will remove the s3 netr_creds_server_step_check()
function.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15240

Signed-off-by: Samuel Cabrero <scabrero@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2023-01-09 14:23:35 +00:00
Florian Weimer
7779050a67 source3/wscript: Remove implicit int and implicit function declarations
This should fix the remaining C89isms in these configure checks.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15281

Signed-off-by: Florian Weimer <fweimer@redhat.com>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Mon Jan  9 11:46:35 UTC 2023 on sn-devel-184
2023-01-09 11:46:35 +00:00
Florian Weimer
d0ee9d5a43 source3/wscript: Fix detection of major/minor macros
These macros are only available via <sys/sysmacros.h> as of glibc
commit e16deca62e16f645213dffd4ecd1153c37765f17 ("[BZ #19239] Don't
include sys/sysmacros.h from sys/types.h."), which went into
glibc 2.28.

This is different from the usual C99 cleanups because it changes
the configure check result with existing compilers that usually
accept implicit function declarations.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15281

Signed-off-by: Florian Weimer <fweimer@redhat.com>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-01-09 10:43:37 +00:00
Florian Weimer
75db84b1e5 buildtools/wafsamba: Avoid calling lib_func without a prototype
This is a backport of commit f4c0a750d4adebcf2342a44e85f04526c34
("WAF: Fix detection of linker features")
to buildtools/wafsamba/samba_conftests.py.  It fixes the check for
rpath support with compilers in strict C99 mode.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15281

Signed-off-by: Florian Weimer <fweimer@redhat.com>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-01-09 10:43:37 +00:00
Ralph Boehme
7545e2c77b nsswitch: avoid calling pthread_getspecific() on an uninitialized key
Found by ASAN:

$ bin/stress-nss-libwbclient
...
==1639426==ERROR: AddressSanitizer: unknown-crash on address 0x7f3907d85000 at pc 0x7f3907d649fb bp 0x7ffc6545f5b0 sp 0x7ffc6545f5a8
READ of size 4 at 0x7f3907d85000 thread T0
    #0 0x7f3907d649fa in winbind_close_sock ../../nsswitch/wb_common.c:220
    #1 0x7f3907d65866 in winbind_destructor ../../nsswitch/wb_common.c:246
    #2 0x7f3907da5d3d in _dl_fini /usr/src/debug/glibc-2.35-20.fc36.x86_64/elf/dl-fini.c:142
    #3 0x7f3907241044 in __run_exit_handlers (/lib64/libc.so.6+0x41044)
    #4 0x7f39072411bf in exit (/lib64/libc.so.6+0x411bf)
    #5 0x7f3907229516 in __libc_start_call_main (/lib64/libc.so.6+0x29516)
    #6 0x7f39072295c8 in __libc_start_main_impl (/lib64/libc.so.6+0x295c8)
    #7 0x56236a2042b4 in _start (/data/git/samba/scratch3/bin/default/nsswitch/stress-nss-libwbclient+0x22b4)

Address 0x7f3907d85000 is a wild pointer inside of access range of size 0x000000000004.
SUMMARY: AddressSanitizer: unknown-crash ../../nsswitch/wb_common.c:220 in winbind_close_sock

The pthread key in wb_global_ctx.key is only initialized if
wb_thread_ctx_initialize() is called via get_wb_global_ctx() -> get_wb_thread_ctx().

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Fri Jan  6 15:04:46 UTC 2023 on sn-devel-184
2023-01-06 15:04:46 +00:00
Stefan Metzmacher
0d09693119 s4:lib/messaging: fix interaction between imessaging_context_destructor and irpc_destructor
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15280

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2023-01-06 14:02:35 +00:00
Andreas Schneider
c29c487c5a third_party: Update waf to version 2.0.25
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2023-01-06 14:02:35 +00:00
Volker Lendecke
dd86376294 smbd: Fix indentation
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Thu Jan  5 18:00:17 UTC 2023 on sn-devel-184
2023-01-05 18:00:17 +00:00
Volker Lendecke
17e9758b53 smbd: Fix CID 1518901 Logically dead code
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2023-01-05 17:04:34 +00:00
Volker Lendecke
c1be654988 smbd: Fix CID 1518902 Use after free
The SMB_REALLOC macro properly deals with failure to realloc, so
overwriting the target variable is correct here.

Signed-off-by: Volker Lendecke <vl@samba.org>
2023-01-05 17:04:34 +00:00
Ralph Boehme
316b8fa4a8 nsswitch: remove winbind_nss_mutex
We're now thread-safe by using TLS, so the global lock isn't needed anymore.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Thu Jan  5 12:34:35 UTC 2023 on sn-devel-184
2023-01-05 12:34:35 +00:00
Ralph Boehme
642a4452ce nsswitch: leverage TLS if available in favour over global locking
The global locking can lead to deadlocks when using nscd: when processing the
first request in winbind, when we know we call into code that will recurse into
winbind we call winbind_off() which sets an environment variable which is later
checked here in the nsswitch module.

But with nscd in the stack, we don't see the env variable in nsswitch, so when
we try to acquire the global lock again, it is already locked and we deadlock.

By using a thread specific winbindd_context, plus a few other thread local global
variables, we don't need a global lock anymore.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2023-01-05 11:33:37 +00:00
Ralph Boehme
ae4a06f4b0 nsswitch: prepare for removing global locking by using TLS
Switch to using TLS for all global variables. No change in behaviour.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2023-01-05 11:33:37 +00:00
Ralph Boehme
347f75499e nsswitch/stress-nss-libwbclient: also test after fork
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2023-01-05 11:33:37 +00:00
Ralph Boehme
29a99e5e12 libreplace: require TLS support if pthread support is available
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2023-01-05 11:33:37 +00:00
Ralph Boehme
73e7d3731d libreplace: update comment on __thread support
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2023-01-05 11:33:37 +00:00
Volker Lendecke
9636b40b05 smbd: Use get_dirent_ea_size() also for BOTH_DIRECTORY_INFO
This is a bit more involved as readdir_attr_data needs to be looked
at. The meaning of this if-statements should be the same though,
readdir_attr_data can only be non-NULL if we don't have a reparse
point around. See the beginning of smbd_marshall_dir_entry().

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Wed Jan  4 09:48:37 UTC 2023 on sn-devel-184
2023-01-04 09:48:37 +00:00
Volker Lendecke
dc98e56460 smbd: Factor out get_dirent_ea_size()
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2023-01-04 08:54:32 +00:00
Volker Lendecke
8000c18837 pylibsmb: Add reparse tag definitions
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2023-01-04 08:54:32 +00:00
Volker Lendecke
ecdb225a7c pylibsmb: Get reparse tag when listing directories
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2023-01-04 08:54:32 +00:00
Volker Lendecke
d4f47d4b86 smbd: Modernize a DBG statement
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2023-01-04 08:54:32 +00:00
Volker Lendecke
eb0e911c73 smbd: Shorten a few lines
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2023-01-04 08:54:32 +00:00
Volker Lendecke
852ce99e2a smbd: Remove duplicate/unused #defines
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2023-01-04 08:54:32 +00:00
Volker Lendecke
7a21dc7564 torture: Fix whitespace
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2023-01-04 08:54:32 +00:00
Volker Lendecke
71610e3633 smbd: Move SMB_QUERY_FILE_UNIX_LINK to smb1_trans2.c
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2023-01-04 08:54:32 +00:00
Volker Lendecke
f48e2489ad smbd: Move get_posix_fsp() to smb1_trans2.c
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2023-01-04 08:54:32 +00:00
Volker Lendecke
6fc64f53a8 smbd: Move SMB_QUERY_POSIX_ACL to smb1_trans2.c
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2023-01-04 08:54:32 +00:00
Volker Lendecke
01e14e0fe1 smbd: Move SMB_QUERY_FILE_UNIX_[BASIC|INFO2] to smb1_trans2.c
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2023-01-04 08:54:32 +00:00
Volker Lendecke
0cfea60792 smbd: Remove an unnecessary if-statement
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2023-01-04 08:54:32 +00:00
Volker Lendecke
65fc2b105a smbd: Remove an unnecessary if-statement
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2023-01-04 08:54:32 +00:00
Volker Lendecke
4f69b76fa1 smbd: Move smb_set_posix_acl() to smb1_trans2.c
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2023-01-04 08:54:32 +00:00
Volker Lendecke
19c41395e5 smbd: Make get_posix_fsp() public
This will go static again soon.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2023-01-04 08:54:32 +00:00
Volker Lendecke
b0dfee968a smbd: smbd_do_qfilepathinfo() does not need lock_data anymore
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2023-01-04 08:54:32 +00:00
Volker Lendecke
e53988cdea smbd: Handle SMB_QUERY_POSIX_LOCK() in call_trans2qfileinfo()
smbd_do_qfilepathinfo() does not use the lock data anymore, we can
pass NULL/0 now.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2023-01-04 08:54:32 +00:00
Volker Lendecke
ad453a3827 smbd: Remove two variables never set after initialization
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2023-01-04 08:54:32 +00:00
Volker Lendecke
2be0e68ec5 smbd: Move SMB_SET_FILE_UNIX_[BASIC|INFO2] to smb1_trans2.c
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2023-01-04 08:54:32 +00:00