1
0
mirror of https://github.com/samba-team/samba.git synced 2025-01-11 05:18:09 +03:00
Commit Graph

24 Commits

Author SHA1 Message Date
Gary Lockyer
34acf5a992 dnsserver: Tighten DNS name checking
Add checks for the maximum permitted length, maximum number of labels
and the maximum label length.  These extra checks will be used by the
DNS wild card handling.

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12952
2017-08-15 08:07:10 +02:00
Ralph Boehme
bea4aec521 librpc/dns: remove original_id from dns_fake_tsig_rec
Cf RFC2845, 3.4.2. "TSIG Variables", the request id (original_id) is not
used in the MAC calculation. This also explains the mysterious 2 bytes
padding.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11520

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-06-16 00:06:27 +02:00
Ralph Boehme
a51f998956 librpc/dns: don't compress strings in TKEY and TSIG responses
Certain DNS clients fail TSIG record MAC validation if the TSIG record
contains compressed strings.

Windows DNS server behaviour seems to be to not send compressed names in
TKEY and TSIG records.

This patch ensures we conform to this behaviour.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11520

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-06-16 00:06:27 +02:00
Stefan Metzmacher
d22a9f427c CVE-2016-0771: dns.idl: make use of dnsp_hinfo
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11128
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11686

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-03-10 06:52:24 +01:00
Stefan Metzmacher
ee8d777bbf CVE-2016-0771: s4:dns_server: fix idl for dns_txt_record
From RFC 1035:

    3.3.14. TXT RDATA format

        +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
        /                   TXT-DATA                    /
        +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+

    where:

    TXT-DATA        One or more <character-string>s.

    TXT RRs are used to hold descriptive text.  The semantics of the text
    depends on the domain where it is found.

Each record contains an array of strings instead of just one string.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11128
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11686

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-03-10 06:52:24 +01:00
Stefan Metzmacher
42524c20a8 CVE-2016-0771: s4:librpc: python_dns and python_dcerpc_dnsp doesn't require client bindings
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11686
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11128

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-03-10 06:52:23 +01:00
Kai Blin
9c7015ecaa idl: Add DNS HINFO record support
Not sure if we need this, bug samba.org specifies it, so this can cause ANY queries
against samba.org to fail.

Signed-off-by: Kai Blin <kai@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>

Autobuild-User(master): Michael Adam <obnox@samba.org>
Autobuild-Date(master): Sun May 26 20:05:38 CEST 2013 on sn-devel-104
2013-05-26 20:05:38 +02:00
Kai Blin
96ed585f09 idl: Add DNS RP record support as per RFC 1183
Not sure if we need this, but samba.org specifies it, so this could cause ANY
queries against samba.org to fail.

Signed-off-by: Kai Blin <kai@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2013-05-26 18:13:29 +02:00
Kai Blin
5bcebb54da idl: Add support for parsing OPT records
Signed-off-by: Kai Blin <kai@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2013-05-26 18:13:26 +02:00
Kai Blin
22fda8cb15 s4 dns: Create IDL entry for TSIG-like record needed for signature check 2012-09-05 19:02:16 +02:00
Kai Blin
558fa4c45a s4 dns: Revert erroneous push from wrong branch
I've pushed the wrong branch for this, sorry about that.

Autobuild-User(master): Kai Blin <kai@samba.org>
Autobuild-Date(master): Wed Sep  5 14:10:54 CEST 2012 on sn-devel-104
2012-09-05 14:10:54 +02:00
Kai Blin
fc9de26497 s4 dns: Handle GSS-TSIG signatures 2012-09-05 08:41:23 +02:00
Kai Blin
74206984da s4 dns: Add TSIG and TKEY records to idl 2012-05-08 13:57:39 +02:00
Kai Blin
c191ad7e13 s4 dns: Implement RFC-compatible update prescan 2011-12-17 02:46:08 +01:00
Kai Blin
a243473b49 s4 dns: the opcode is called OPCODE_UPDATE in the RFC, not OPCODE_REGISTER 2011-11-04 15:51:59 +01:00
Kai Blin
1dbcb61c79 dns: Move the dns_srv_record to the correct place in the idl file
Autobuild-User: Kai Blin <kai@samba.org>
Autobuild-Date: Sun Oct  2 13:35:49 CEST 2011 on sn-devel-104
2011-10-02 13:35:49 +02:00
Kai Blin
f163bd1dac dns: Add support for TXT record to idl file 2011-10-02 12:00:27 +02:00
Kai Blin
f98ebcf43f dns: The QCLASS is called IN, not IP 2011-09-28 02:02:36 +02:00
Kai Blin
cebce2b9a4 s4 dns: More work on updates 2010-10-23 10:17:06 +00:00
Kai Blin
a6305c4a16 s4 dns: Better error handling when parsing invalid or unknown records 2010-10-23 10:17:06 +00:00
Kai Blin
a7b833ec7e s4 dns: Reply to a name request with an A record.
The first real answer to a DNS request. Still uses hardcoded reply.
2010-10-23 10:17:05 +00:00
Kai Blin
719a6bbfed ndr dns: Add simple parser 2010-10-23 10:17:05 +00:00
Kai Blin
caf4196899 dns/nbt: Fix spelling of the "authoritative" flag. 2010-10-23 10:17:05 +00:00
Kai Blin
97868713a0 idl: Add idl describing DNS structures 2010-10-23 10:17:05 +00:00