1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-24 21:34:56 +03:00
Commit Graph

1838 Commits

Author SHA1 Message Date
Volker Lendecke
4ddd277c0b smbXcli: Pass negotiate contexts through smbXcli_negprot_send/recv
We already don't allow setting max_credits in the sync wrapper, so
omit the contexts there as well.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Fri Aug 26 19:54:03 UTC 2022 on sn-devel-184
2022-08-26 19:54:03 +00:00
Joseph Sutton
75e03ea021 libcli/smb: Set error status if 'iov' pointer is NULL
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15152

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Mon Aug 22 09:03:29 UTC 2022 on sn-devel-184
2022-08-22 09:03:29 +00:00
Joseph Sutton
40d4912d84 libcli/smb: Ensure we call tevent_req_nterror() on failure
Commit 3594c3ae20 added a NULL check for
'inhdr', but it meant we didn't always call tevent_req_nterror() when we
should.

Now we handle connection errors. We now also set an error status if the
NULL check fails.

I noticed this when an ECONNRESET error from a server refusing SMB1
wasn't handled, and the client subsequently hung in epoll_wait().

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15152

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-08-22 08:02:36 +00:00
Andreas Schneider
563a2c8d72 waf: Fix SO version number of libsamba-errors
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15141

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
2022-08-17 06:13:35 +00:00
Andreas Schneider
63c4b16d2f libcli:auth: Add test for decode_pwd_string_from_buffer514()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-07-28 11:51:29 +00:00
Andreas Schneider
2f4a80322b libcli:auth: Add decode_pwd_string_from_buffer514()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-07-28 11:51:29 +00:00
Andreas Schneider
2226806ce0 libcli:auth: Add test for extract_pwd_blob_from_buffer514()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-07-28 11:51:29 +00:00
Andreas Schneider
12f4bb9cc1 libcli:auth: Add extract_pwd_blob_from_buffer514()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-07-28 11:51:29 +00:00
Andreas Schneider
b39abe916d libcli:auth: Implment a common create_pw_buffer_from_blob()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-07-28 11:51:29 +00:00
Andreas Schneider
626b0f4891 libcli:auth: Use extract_pw_from_buffer() in decode_pw_buffer()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-07-28 11:51:29 +00:00
Andreas Schneider
e87facfd89 libcli:auth: Keep data of extract_pw_from_buffer() secret
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-07-28 11:51:29 +00:00
Andreas Schneider
e181dd7b76 libcli:auth: Add test for encode_pwd_buffer514_from_str()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-07-28 11:51:28 +00:00
Andreas Schneider
1b142b72bd libcli:auth: Add encode_pw_buffer_from_str()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-07-28 11:51:28 +00:00
Andreas Schneider
5da60573b5 libcli:auth: Implement a generic encode_pwd_buffer_from_str()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-07-28 11:51:28 +00:00
Andreas Schneider
ed22f0c43c libcli:auth: Remove trailing spaces from proto.h
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-07-28 11:51:28 +00:00
Volker Lendecke
217e7c162c libcli: Modernize a few DEBUG statements
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2022-07-25 12:04:33 +00:00
Joseph Sutton
45f2e3631e libcli/security: Fix typos
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-06-14 07:21:29 +00:00
Joseph Sutton
2c9a4ef86e libcli:util: Update werror table
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-06-14 07:21:29 +00:00
Michael Tokarev
17c733d946 spelling: connnect encrytion exisit expection explicit invalide missmatch paramater paramter partion privilige relase reponse seperate unkown verson authencication progagated
Tree-wide spellcheck for some common misspellings.

source3/utils/status.c has misspelled local variable (unkown_dialect).

"missmatch" is a known historical misspelling, only the incorrect
misspellings are fixed.

source3/locale/net/de.po has the spelling error (unkown) in two msgids -
it probably should be updated with current source.

Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2022-06-10 18:12:33 +00:00
Joseph Sutton
feb36dbebf lib/util: Change function to mem_equal_const_time()
Since memcmp_const_time() doesn't act as an exact replacement for
memcmp(), and its return value is only ever compared with zero, simplify
it and emphasize the intention of checking equality by returning a bool
instead.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-06-09 22:49:29 +00:00
Joseph Sutton
a554e2ce53 lib/util: Change function to data_blob_equal_const_time()
Since data_blob_cmp_const_time() doesn't act as an exact replacement for
data_blob_cmp(), and its return value is only ever compared with zero,
simplify it and emphasize the intention of checking equality by
returning a bool instead.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-06-09 22:49:29 +00:00
Joseph Sutton
ae6634c787 auth: Use constant-time memcmp when comparing sensitive buffers
This helps to avoid timing attacks.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15010

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-06-09 22:49:29 +00:00
Pavel Filipenský
d4e5712caf libcli: Covscan: unchecked return value for file_save()
Signed-off-by: Pavel Filipenský <pfilipen@redhat.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2022-05-14 03:49:32 +00:00
Pavel Filipenský
6781ab1172 libcli: Fix trailing whitespace in netlogon.c
Signed-off-by: Pavel Filipenský <pfilipen@redhat.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2022-05-14 03:49:32 +00:00
Stefan Metzmacher
54c6cf8666 libcli/smb: allow SMB2 Negotiate responses with security_offset = 0 and security_length = 0
This fixes connections against the Azure SMB3 server.

It's not possible to demonstrate the bug with a test and a knownfail
entry, because it fails to even startup the test environments,
but the following change to our server demonstrates the problem
and shows the fix works:

    diff --git a/source3/smbd/smb2_negprot.c b/source3/smbd/smb2_negprot.c
    index da567951c0bf..25fdaea2df7b 100644
    --- a/source3/smbd/smb2_negprot.c
    +++ b/source3/smbd/smb2_negprot.c
    @@ -711,6 +711,8 @@ NTSTATUS smbd_smb2_request_process_negprot(struct smbd_smb2_request *req)
                    }
            }

    +       security_buffer = data_blob_null;
    +
            if (out_negotiate_context_blob.length != 0) {
                    static const uint8_t zeros[8];
                    size_t pad = 0;
    @@ -759,6 +761,8 @@ NTSTATUS smbd_smb2_request_process_negprot(struct smbd_smb2_request *req)
                    return smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
            }

    +       security_offset = 0;
    +
            SSVAL(outbody.data, 0x00, 0x40 + 1);    /* struct size */
            SSVAL(outbody.data, 0x02,
                  security_mode);                   /* security mode */

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15050

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Mon May  2 20:13:10 UTC 2022 on sn-devel-184
2022-05-02 20:13:10 +00:00
Joseph Sutton
1137ebc654 sddl: Remove SDDL SID strings unsupported by Windows
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-03-17 23:11:37 +00:00
Joseph Sutton
732d17a129 sddl: Add new SDDL SID strings
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-03-17 23:11:37 +00:00
Joseph Sutton
e61fa573fe sddl: Fix incorrect SDDL SID strings
Change the values to match those used by Windows.

Verified with PowerShell commands of the form:
New-Object Security.Principal.SecurityIdentifier ER

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-03-17 23:11:37 +00:00
Jeremy Allison
3e021c3762 s3: libcli: Rename smb_key_derivation() -> smb1_key_derivation()
Signed-off-by: Jeremy Allison <jra@samba.org>
Signed-off-by: David Mulder <dmulder@samba.org>
2022-03-08 22:12:37 +00:00
Jeremy Allison
0b391fc19f s3: libcli: Rename smb_signing_is_negotiated() -> smb1_signing_is_negotiated()
Signed-off-by: Jeremy Allison <jra@samba.org>
Signed-off-by: David Mulder <dmulder@samba.org>
2022-03-08 22:12:37 +00:00
Jeremy Allison
7a385775ee s3: libcli: Rename smb_signing_set_negotiated() -> smb1_signing_set_negotiated()
Signed-off-by: Jeremy Allison <jra@samba.org>
Signed-off-by: David Mulder <dmulder@samba.org>
2022-03-08 22:12:37 +00:00
Jeremy Allison
79633b42d6 s3: libcli: Rename smb_signing_is_mandatory() -> smb1_signing_is_mandatory()
Signed-off-by: Jeremy Allison <jra@samba.org>
Signed-off-by: David Mulder <dmulder@samba.org>
2022-03-08 22:12:37 +00:00
Jeremy Allison
e42fc9bc24 s3: libcli: Rename smb_signing_is_desired() -> smb1_signing_is_desired()
Signed-off-by: Jeremy Allison <jra@samba.org>
Signed-off-by: David Mulder <dmulder@samba.org>
2022-03-08 22:12:37 +00:00
Jeremy Allison
2fd2916971 s3: libcli: Remove unused smb_signing_is_allowed()
Signed-off-by: Jeremy Allison <jra@samba.org>
Signed-off-by: David Mulder <dmulder@samba.org>
2022-03-08 22:12:37 +00:00
Jeremy Allison
0c8bc1bf56 s3: libcli: Rename smb_signing_is_active() -> smb1_signing_is_active()
Signed-off-by: Jeremy Allison <jra@samba.org>
Signed-off-by: David Mulder <dmulder@samba.org>
2022-03-08 22:12:37 +00:00
Jeremy Allison
8dd252ad91 s3: libcli: Rename smb_signing_activate() -> smb1_signing_activate()
Fix the debugs that also used this name.

Signed-off-by: Jeremy Allison <jra@samba.org>
Signed-off-by: David Mulder <dmulder@samba.org>
2022-03-08 22:12:37 +00:00
Jeremy Allison
84a498feec s3: libcli: Rename smb_signing_check_pdu() -> smb1_signing_check_pdu()
Fix the debugs that also used this name.

Signed-off-by: Jeremy Allison <jra@samba.org>
Signed-off-by: David Mulder <dmulder@samba.org>
2022-03-08 22:12:37 +00:00
Jeremy Allison
6a68caff96 s3: libcli: Rename smb_signing_sign_pdu() -> smb1_signing_sign_pdu()
Fix the debugs that also used this name.

Signed-off-by: Jeremy Allison <jra@samba.org>
Signed-off-by: David Mulder <dmulder@samba.org>
2022-03-08 22:12:37 +00:00
Jeremy Allison
fd9325587c s3: libcli: Rename smb_signing_cancel_reply() -> smb1_signing_cancel_reply()
Signed-off-by: Jeremy Allison <jra@samba.org>
Signed-off-by: David Mulder <dmulder@samba.org>
2022-03-08 22:12:37 +00:00
Jeremy Allison
e563725a19 s3: libcli: Rename smb_signing_next_seqnum() -> smb1_signing_next_seqnum()
Signed-off-by: Jeremy Allison <jra@samba.org>
Signed-off-by: David Mulder <dmulder@samba.org>
2022-03-08 22:12:37 +00:00
Jeremy Allison
00d8b05ddb s3: libcli: Rename smb_signing_md5() -> smb1_signing_md5()
Fix the debug that also used this name.

Signed-off-by: Jeremy Allison <jra@samba.org>
Signed-off-by: David Mulder <dmulder@samba.org>
2022-03-08 22:12:37 +00:00
Jeremy Allison
7e82ac3a40 s3: libcli: Rename smb_signing_good() -> smb1_signing_good()
Fix the debugs that also used this name.

Signed-off-by: Jeremy Allison <jra@samba.org>
Signed-off-by: David Mulder <dmulder@samba.org>
2022-03-08 22:12:37 +00:00
Jeremy Allison
6ae33a62bc s3: libcli: Rename smb_signing_init() -> smb1_signing_init()
Signed-off-by: Jeremy Allison <jra@samba.org>
Signed-off-by: David Mulder <dmulder@samba.org>
2022-03-08 22:12:37 +00:00
Jeremy Allison
cba8ba327f s3: libcli: Rename smb_signing_init_ex() -> smb1_signing_init_ex()
Signed-off-by: Jeremy Allison <jra@samba.org>
Signed-off-by: David Mulder <dmulder@samba.org>
2022-03-08 22:12:37 +00:00
Jeremy Allison
aee7bfa079 s3: libcli: Rename static smb_signing_reset_info() -> smb1_signing_reset_info()
Signed-off-by: Jeremy Allison <jra@samba.org>
Signed-off-by: David Mulder <dmulder@samba.org>
2022-03-08 22:12:37 +00:00
Jeremy Allison
41393579de s3: Simple rename 'struct smb_signing_state' -> 'struct smb1_signing_state'
This is only used by the SMB1 signing code, except for one
bool for SMB2 which we will replace next.

Signed-off-by: Jeremy Allison <jra@samba.org>
Signed-off-by: David Mulder <dmulder@samba.org>
2022-03-08 22:12:37 +00:00
Stefan Metzmacher
735f3d7dde libcli/smb: let smb2_signing_decrypt_pdu() cope with gnutls_aead_cipher_decrypt() ptext_len bug
The initial implementation of gnutls_aead_cipher_decrypt() had a bug and
used:
    *ptext_len = ctext_len;
instead of:
    *ptext_len = ctext_len - tag_size;

This got fixed with gnutls 3.5.2.

As we only require gnutls 3.4.7 we need to cope with this...

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14968

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Wed Feb  2 18:29:08 UTC 2022 on sn-devel-184
2022-02-02 18:29:08 +00:00
Stefan Metzmacher
99182af4ab libcli/smb: fix error checking in smb2_signing_decrypt_pdu() invalid ptext_len
When the ptext_size != m_total check fails, we call this:

   status = gnutls_error_to_ntstatus(rc, NT_STATUS_INTERNAL_ERROR);
   goto out;

As rc is 0 at that point we'll exit smb2_signing_decrypt_pdu()
with NT_STATUS_OK, but without copying the decrypted data
back into the callers buffer. Which leads to strange errors
in the caller.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14968

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-02-02 17:36:35 +00:00
Jeremy Allison
2e72b9cd2d s3: smbd: Add the definition for SMB2_FIND_POSIX_INFORMATION info level.
Will be used by smb2_query_directory. Not yet used or available.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-02-01 16:30:37 +00:00
Jeremy Allison
722d0d3c55 libcli: Add SMB2 posix negotiate context flag.
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-02-01 16:30:37 +00:00