1
0
mirror of https://github.com/samba-team/samba.git synced 2025-01-11 05:18:09 +03:00
Commit Graph

353 Commits

Author SHA1 Message Date
Stefan Metzmacher
3e227d8544 s3:libsmb: pass CLI_FULL_CONNECTION_* flags via cli_connect_nb()
metze

Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Thu Sep  8 10:21:50 CEST 2011 on sn-devel-104
2011-09-08 10:21:50 +02:00
Stefan Metzmacher
a6be0820d0 s3:web/swat: use strtoll() instead of atoi/atol/atoll
This is more portable, as we have a strtoll replacement
in lib/replace.

metze

Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Sat Aug  6 11:55:45 CEST 2011 on sn-devel-104
2011-08-06 11:55:45 +02:00
Björn Jacke
d3b4d75364 s3/swat: use strlcat instead of strncat to fix build on old Linux distros
SLES 9's glibc for example had weird macros where the use of strncat resulted
in the use of strcat which we don't allow.

Signed-off-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User: Björn Jacke <bj@sernet.de>
Autobuild-Date: Thu Aug  4 17:50:24 CEST 2011 on sn-devel-104
2011-08-04 17:50:24 +02:00
Kai Blin
c79e08fb1b s3 swat: Create random nonce in CGI mode
In CGI mode, we don't get access to the user's password, which would
reduce the hash used so far to parameters an attacker can easily guess.
To work around this, read the nonce from secrets.tdb or generate one if
it's not there.
Also populate the C_user field so we can use that for token creation.

Signed-off-by: Kai Blin <kai@samba.org>

Autobuild-User: Jeremy Allison <jra@samba.org>
Autobuild-Date: Tue Jul 26 23:33:24 CEST 2011 on sn-devel-104
2011-07-26 23:33:24 +02:00
Kai Blin
52d2ba7103 s3 swat: Add time component to XSRF token
Signed-off-by: Kai Blin <kai@samba.org>
2011-07-26 22:22:25 +02:00
Kai Blin
b5d63c3c11 s3 swat: Add XSRF protection to printer page
Signed-off-by: Kai Blin <kai@samba.org>
2011-07-26 22:22:25 +02:00
Kai Blin
072c199180 s3 swat: Add XSRF protection to password page
Signed-off-by: Kai Blin <kai@samba.org>
2011-07-26 22:22:25 +02:00
Kai Blin
c02df79f61 s3 swat: Add XSRF protection to shares page
Signed-off-by: Kai Blin <kai@samba.org>
2011-07-26 22:22:25 +02:00
Kai Blin
68f8924c7c s3 swat: Add XSRF protection to globals page
Signed-off-by: Kai Blin <kai@samba.org>
2011-07-26 22:22:25 +02:00
Kai Blin
99fa6b386a s3 swat: Add XSRF protection to wizard page
Signed-off-by: Kai Blin <kai@samba.org>
2011-07-26 22:22:25 +02:00
Kai Blin
ab98edd79d s3 swat: Add XSRF protection to wizard_params page
Signed-off-by: Kai Blin <kai@samba.org>
2011-07-26 22:22:25 +02:00
Kai Blin
00d255fc1d s3 swat: Add XSRF protection to viewconfig page
Signed-off-by: Kai Blin <kai@samba.org>
2011-07-26 22:22:25 +02:00
Kai Blin
15ed2a0eed s3 swat: Add XSRF protection to status page
Signed-off-by: Kai Blin <kai@samba.org>
2011-07-26 22:22:25 +02:00
Kai Blin
c379b3623a s3 swat: Add support for anti-XSRF token 2011-07-26 22:22:25 +02:00
Kai Blin
b7521dc756 s3 swat: Allow getting the user's HTTP auth password
Signed-off-by: Kai Blin <kai@samba.org>
2011-07-26 22:22:25 +02:00
Karolin Seeger
cc86a11b9e s3-swat: Fix typo.
Thanks to Simo for reporting!

Karolin
(cherry picked from commit 9f73c1990a)
(cherry picked from commit bcb052c292)
2011-07-26 22:22:25 +02:00
Kai Blin
dc50cf38c1 s3 swat: Fix possible XSS attack (bug #8289)
Nobuhiro Tsuji of NTT DATA SECURITY CORPORATION reported a possible XSS attack
against SWAT, the Samba Web Administration Tool. The attack uses reflection to
insert arbitrary content into the "change password" page.

This patch fixes the reflection issue by not printing user-specified content on
the website anymore.

Signed-off-by: Kai Blin <kai@samba.org>
2011-07-26 22:22:25 +02:00
Jeremy Allison
ee34c25c8a First part of fix for bug 8310 - toupper_ascii() is broken on big-endian systems
Remove
int toupper_ascii(int c);
int tolower_ascii(int c);
int isupper_ascii(int c);
int islower_ascii(int c);

and replace with their _m equivalents, as they are identical.
2011-07-19 13:19:29 -07:00
Andrew Bartlett
d4ef70a764 param: Finish conversion from lp_wins_support() -> lp_we_are_a_wins_server()
Jermey started this in 1997 with 0aa493cc03

(avoiding the duplicate function makes it easier to generate the
struct loadparm_globals).

Andrew Bartlett
2011-07-02 12:31:34 +10:00
Andrew Bartlett
489f528857 param: Merge param headers into lib/param/loadparm.h
This defines a common table format, so we can in future define a
common table.

Andrew Bartlett
2011-06-29 15:44:09 +10:00
Andrew Bartlett
e63d5d2cd5 s3-param use lp_parm_ptr() rather than parm.ptr directly
This will help with a change from .ptr to .offset

Andrew Bartlett

Autobuild-User: Andrew Bartlett <abartlet@samba.org>
Autobuild-Date: Wed Jun 29 03:26:21 CEST 2011 on sn-devel-104
2011-06-29 03:26:21 +02:00
Andrew Bartlett
fb3d5ade9d s3-swat Remove d_printf() calls
These calls only ever output ASCII strings (protocol strings and
debugging), and never user content, so make it clear that these don't
need to be converted into UTF8.

Andrew Bartlett
2011-06-23 13:47:27 +02:00
Andrew Bartlett
74eed8f3ed s3-param Remove special case for global_myname(), rename to lp_netbios_name()
There is no reason this can't be a normal constant string in the
loadparm system, now that we have lp_set_cmdline() to handle overrides
correctly.

Andrew Bartlett
2011-06-09 12:40:09 +02:00
Andrew Bartlett
3d15137653 s3-talloc Change TALLOC_ARRAY() to talloc_array()
Using the standard macro makes it easier to move code into common, as
TALLOC_ARRAY isn't standard talloc.
2011-06-09 12:40:08 +02:00
Volker Lendecke
230cb3b904 s3: Use cli_connect_nb in smbd_running() 2011-05-28 20:50:10 +02:00
Günther Deschner
27022587e3 s3-libsmb: move protos to libsmb/proto.h
Guenther
2011-05-06 16:37:18 +02:00
Jeremy Allison
f85e095dd2 More simple const fixups. 2011-05-05 23:56:08 +02:00
Andrew Bartlett
3e85b960fa dynconfig: Have only one dynconfig.o in the common code. 2011-04-27 22:22:26 +10:00
Jeremy Allison
c109a70531 Fix convert_string() to take a *converted_size arg. and return a bool.
Makes these interfaces much harder to misuse and easier to ensure error
checking.

Autobuild-User: Jeremy Allison <jra@samba.org>
Autobuild-Date: Wed Mar 30 23:59:37 CEST 2011 on sn-devel-104
2011-03-30 23:59:37 +02:00
Günther Deschner
7e73214ebf s3-auth: use auth.h where needed.
Guenther
2011-03-30 01:13:09 +02:00
Günther Deschner
2377039738 s3-locking: move locking prototypes out of proto.h.
Will later become part of locking.h

Guenther
2011-03-30 01:13:09 +02:00
Günther Deschner
6b76909f5e s3-build: only include intl protos where needed.
Guenther
2011-03-30 01:13:08 +02:00
Günther Deschner
235f148590 s3-passdb: use passdb headers where needed.
Guenther
2011-03-30 01:13:08 +02:00
Günther Deschner
0e771263ee s3-includes: only include system/filesys.h when needed.
Guenther
2011-03-30 01:13:07 +02:00
Günther Deschner
49fcf653b1 s3-includes: only include system/passwd.h when needed.
Guenther
2011-03-30 01:13:07 +02:00
Günther Deschner
d85f140826 s3-winbind: remove global inclusion of libwbclient.
Guenther
2011-03-30 01:13:06 +02:00
Andrew Tridgell
15e84a9a09 charcnv: removed the allow_badcharcnv and allow_bad_conv options to convert_string*()
we shouldn't accept bad multi-byte strings, it just hides problems

Autobuild-User: Andrew Tridgell <tridge@samba.org>
Autobuild-Date: Thu Mar 24 01:47:26 CET 2011 on sn-devel-104
2011-03-24 01:47:26 +01:00
Andrew Tridgell
c8297073db s3-fault: removed the cont_fn from fault_setup()
cont_fn() was supposed to be a way to continue after a seg fault. It
could never be called however, as smb_panic() from fault_report()
could never return, as dump_core() never returns at the end of
smb_panic()

Autobuild-User: Andrew Tridgell <tridge@samba.org>
Autobuild-Date: Tue Mar 22 05:07:58 CET 2011 on sn-devel-104
2011-03-22 05:07:58 +01:00
Günther Deschner
8225c0ad6c s3-printing: only include printing where really needed.
Guenther
2011-02-22 21:52:18 +01:00
Volker Lendecke
849816d0df s3: Fix a type error 2011-01-08 11:30:18 +01:00
Volker Lendecke
5a3bc194ad s3: Fix some nonempty blank lines 2011-01-08 11:30:17 +01:00
David Disseldorp
0b188e7784 s3-printing: Initiate pcap reload from parent smbd
Since commit 7022554, smbds share a printcap cache (printer_list.tdb),
therefore ordering of events between smbd processes is important when
updating printcap cache information. Consider the following two process
example:
1) smbd1 receives HUP or printcap cache time expiry
2) smbd1 checks whether pcap needs refresh, it does
3) smbd1 marks pcap as refreshed
4) smbd1 forks child1 to obtain cups printer info
5) smbd2 receives HUP or printcap cache time expiry
6) smbd2 checks whether pcap needs refresh, it does not (due to step 3)
7) smbd2 reloads printer shares prior to child1 completion (stale pcap)
8) child1 completion, pcap cache (printer_list.tdb) is updated by smbd1
9) smbd1 reloads printer shares based on new pcap information

In this case both smbd1 and smbd2 are reliant on the pcap update
performed on child1 completion.
The prior commit "reload shares after pcap cache fill" ensures that
smbd1 only reloads printer shares following pcap update, however smbd2
continues to present shares based on stale pcap data.

This commit addresses the above problem by driving pcap cache and
printer share updates from the parent smbd process.
1) smbd0 (parent) receives a HUP or printcap cache time expiry
2) smbd0 forks child0 to obtain cups printer info
3) child0 completion, pcap cache (printer_list.tdb) is updated by smbd0
4) smbd0 reloads printer shares
5) smbd0 notifies child smbds of pcap update via message_send_all()
6) child smbds read fresh pcap data and reload printer shares

This architecture has the additional advantage that only a single
process (the parent smbd) requests printer information from the printcap
backend.

Use time_mono in housekeeping functions As suggested by Björn Jacke.
2011-01-07 15:37:39 -08:00
David Disseldorp
04248c2cfa s3-printing: reload shares after pcap cache fill
Since commit eada8f8a, updates to the cups pcap cache are performed
asynchronously - cups_cache_reload() forks a child process to request
cups printer information and notify the parent smbd on completion.

Currently printer shares are reloaded immediately following the call to
cups_cache_reload(), this occurs prior to smbd receiving new cups pcap
information from the child process. Such behaviour can result in stale
print shares as outlined in bug 7836.

This fix ensures print shares are only reloaded after new pcap data has
been received.

Pair-Programmed-With: Lars Müller <lars@samba.org>
2011-01-07 15:37:39 -08:00
Volker Lendecke
6ba4bddb61 s3: Make name_query use /tmp/.nmbd/unexpected 2011-01-07 13:28:05 +01:00
Volker Lendecke
4622812a41 s3: Make name_query return NTSTATUS
Also use talloc for the result

Autobuild-User: Volker Lendecke <vlendec@samba.org>
Autobuild-Date: Tue Dec 28 18:21:05 CET 2010 on sn-devel-104
2010-12-28 18:21:05 +01:00
Andrew Bartlett
ed111d11eb s3-debug Move 'load_case_tables()' before lp_set_cmdline() and popt calls
The problem here is that we cannot run lp_set_cmdline() (directly or
indirectly via the popt helpers) until load_case_tables() has been run.

However, load_case_tables does not have auto-initialisation, so we
must init it once, and once only.

Andrew Bartlett
2010-11-02 04:36:04 +00:00
Andrew Bartlett
9da4ace1d9 s3-debug Impove setup_logging() to specify logging to stderr
This change improves the setup_logging() API so that callers which
wish to set up logging to stderr can simply ask for it, rather than
directly modify the dbf global variable.

Andrew Bartlett
2010-11-02 04:36:04 +00:00
Jeremy Allison
e1cfca1e2e Make getpwnam_alloc() static to lib/username.c, and ensure all username lookups go
through Get_Pwnam_alloc(), which is the correct wrapper function. We were using
it *some* of the time anyway, so this just makes us properly consistent.

Jeremy.

Autobuild-User: Jeremy Allison <jra@samba.org>
Autobuild-Date: Wed Oct 20 16:02:12 UTC 2010 on sn-devel-104
2010-10-20 16:02:12 +00:00
Andrew Bartlett
f768b32e37 libcli/security Provide a common, top level libcli/security/security.h
This will reduce the noise from merges of the rest of the
libcli/security code, without this commit changing what code
is actually used.

This includes (along with other security headers) dom_sid.h and
security_token.h

Andrew Bartlett

Autobuild-User: Andrew Bartlett <abartlet@samba.org>
Autobuild-Date: Tue Oct 12 05:54:10 UTC 2010 on sn-devel-104
2010-10-12 05:54:10 +00:00
Volker Lendecke
4ebbbdd011 s3: Remove talloc_autofree_context() from swat
In both cases, pass is freed immediately
2010-09-26 03:29:29 +02:00