1
0
mirror of https://github.com/samba-team/samba.git synced 2025-01-11 05:18:09 +03:00
Commit Graph

118704 Commits

Author SHA1 Message Date
Martin Schwenke
52227d1973 ctdb-tests: Reformat node_has_status()
Re-indent and drop non-POSIX left-parenthesis from case labels.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14085

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
2019-08-21 11:50:30 +00:00
Andreas Schneider
c3f9698175 lib:crypto: Do not build AES-CMAC if we use GnuTLS that supports it
This requires GnuTLS >= 3.6.5.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Wed Aug 21 11:14:11 UTC 2019 on sn-devel-184
2019-08-21 11:14:11 +00:00
Andrew Bartlett
70ff03ecb6 libcli/smb: Use gnutls_error_to_ntstatus() in smb2_signing_check_pdu()
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2019-08-21 09:57:32 +00:00
Andreas Schneider
1490f92600 libcli:smb: Use GnuTLS AES128 CMAC in smb2_signing_check_pdu()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-08-21 09:57:32 +00:00
Andrew Bartlett
9d8ffc81a5 libcli/smb: Use gnutls_error_to_ntstatus() in smb2_signing_sign_pdu()
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2019-08-21 09:57:32 +00:00
Andreas Schneider
ee11e3ffd8 libcli:smb: Use GnuTLS AES128 CMAC in smb2_signing_sign_pdu()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Adapted by Andrew Bartlett to followup from earlier patch to
allow compile without GnuTLS over the whole series.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2019-08-21 09:57:32 +00:00
Andreas Schneider
69be6b8416 waf: Check for AES128 CMAC support in GnuTLS
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-08-21 09:57:32 +00:00
Andreas Schneider
33bca1fb80 s3:smbd: Use GnuTLS for AES constants
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Adapted to remove Samba AES

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2019-08-21 09:57:32 +00:00
Andreas Schneider
b51c4293f7 s3:smbd: Use smb2_signing_key structure for the decryption key
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-08-21 09:57:32 +00:00
Andreas Schneider
95e1c85a47 s3:smbd: Use smb2_signing_key structure for the encryption key
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-08-21 09:57:32 +00:00
Andreas Schneider
87832f6140 libcli:smb: Use a smb2_signing_key for storing the decryption key
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-08-21 09:57:32 +00:00
Andreas Schneider
48116a30d5 libcli:smb: Use a smb2_signing_key for storing the encryption key
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-08-21 09:57:31 +00:00
Andreas Schneider
37dc63e8af libcli:smb: Add gnutls_aead_cipher_hd_t to smb2_signing_key structure
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Adapted to remove Samba AES support

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2019-08-21 09:57:31 +00:00
Andreas Schneider
1b384f378c libcli:smb: Use GnuTLS for AES constants
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Adapted to remove Samba AES support

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2019-08-21 09:57:31 +00:00
Andreas Schneider
43a941f51b libcli:smb: Define SMB2_AES_128_CCM_NONCE_SIZE
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-08-21 09:57:31 +00:00
Andrew Bartlett
068da56a20 build: Remove explicit check for HAVE_GNUTLS_AEAD as we require GnuTLS 3.4.7
We strictly require it and if this were to fail we would want the compile to fail.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2019-08-21 09:57:31 +00:00
Andrew Bartlett
85a1c49739 s4-samdb: Remove duplicate encrypted_secrets code using internal Samba AES
We now rely on GnuTLS 3.4.7 or later.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2019-08-21 09:57:31 +00:00
Andrew Bartlett
e9859ad356 lib/crypto: Remove unused RC4 code from Samba
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2019-08-21 09:57:31 +00:00
Andrew Bartlett
2d54559aad s4-rpc_server/backupkey: consistently check error codes from GnuTLS
This uses the new gnutls_error_to_werror()

This should resolve Coverity 1452111 as forwarded by Volker.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2019-08-21 09:57:31 +00:00
Andrew Bartlett
52b91cb33c s4-rpc_server: Remove Heimdal-based BackupKey server
We rely on a modern GnuTLS now.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2019-08-21 09:57:31 +00:00
Andrew Bartlett
974cebdf95 build: Set minimum GnuTLS version at 3.4.7
This will soon be required for encrypted_secrets in the AD DC, the BackupKey server
and SMB2 as we remove use of the internal AES code.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2019-08-21 09:57:31 +00:00
Andreas Schneider
1f6104f09a lib:crypto: Prepare not to build AES or AES-CMAC if we use GnuTLS support it
Samba will soon require GnuTLS >= 3.4.7.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Adjusted by Andrew Bartlett from an earlier more comprehensive patch by Andreas

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2019-08-21 09:57:31 +00:00
Andrew Bartlett
fa8eddc39b auth/gensec: Use gnutls_error_to_ntstatus() in netsec_do_seal()
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2019-08-21 09:57:31 +00:00
Andreas Schneider
025f6a135f auth:gensec: Use GnuTLS AES CFB8 in netsec_do_seal()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-08-21 09:57:30 +00:00
Andrew Bartlett
3b27fd8a49 auth/gensec: Use gnutls_error_to_ntstatus() consistently in schannel
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2019-08-21 09:57:30 +00:00
Andreas Schneider
58c781dc93 auth:gensec: Use GnuTLS AES128 CFB8 in netsec_do_seq_num()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-08-21 09:57:30 +00:00
Andrew Bartlett
fefd95091c auth/credentials: Check NTSTATUS return from netlogon_creds_aes_encrypt()
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2019-08-21 09:57:30 +00:00
Andrew Bartlett
1aa249e7f4 s3-librpc: Remove unused init_netr_CryptPassword()
Unused since 38d4dba374 in 2013

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2019-08-21 09:57:30 +00:00
Andrew Bartlett
1e427f55d7 s4-rpc_server: Check NTSTATUS return value from netlogon_creds_aes_decrypt()
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2019-08-21 09:57:30 +00:00
Andrew Bartlett
2f827bec8c s3-rpc_server: Check NTSTATUS return value from netlogon_creds_aes_decrypt()
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2019-08-21 09:57:30 +00:00
Andrew Bartlett
d515b255aa libcli:auth Check NTSTATUS from netlogon_creds_aes_{en,de}crypt()
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2019-08-21 09:57:30 +00:00
Andrew Bartlett
5ae119e7e9 crypto: Update REQUIREMENTS file with new minimum version
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2019-08-21 09:57:30 +00:00
Andrew Bartlett
8ec796f1a1 libcli:auth Return NTSTATUS from netlogon_creds_aes_decrypt()
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2019-08-21 09:57:30 +00:00
Andreas Schneider
a967285861 libcli:auth: Use GnuTLS AES128 CFB for netlogon_creds_aes_decrypt()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-08-21 09:57:30 +00:00
Andreas Schneider
ded5aad21b libcli:auth: Return NTSTATUS for netlogon_creds_aes_encrypt()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Adapted by Andrew Bartlett to use gnutls_error_to_ntstatus()

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2019-08-21 09:57:29 +00:00
Andreas Schneider
054efd118d libcli:auth: Use GnuTLS AES128 CFB for netlogon_creds_aes_encrypt()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-08-21 09:57:29 +00:00
Andreas Schneider
cd97c47873 libcli:auth: Use netlogon_creds_aes_encrypt() in netlogon_creds_step_crypt()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-08-21 09:57:29 +00:00
Andreas Schneider
20a42459df waf: Check for GNUTLS AES CFB support
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-08-21 09:57:29 +00:00
Andreas Schneider
d46e538d52 s4:samdb: Only include necessary header files in encrypted_secrets
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-08-21 09:57:29 +00:00
Andreas Schneider
7bf3c5d764 s4:samdb: Remove dual-stack mode from (test_)encrypted_secrets
Now we either build with GnuTLS or Samba crypto. If a modern GnuTLS
version is detected that will be used and Samba crypto wont be
available.

This removes the dual-stack mode that encrypted with one and decrypted
with the other in the testsuite.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Commit message clarified by Andrew Bartlett

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2019-08-21 09:57:29 +00:00
Andrew Bartlett
92b9cdf99d encrypted_secrets: Add known and expected value test
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2019-08-21 09:57:29 +00:00
Andreas Schneider
feccdebe15 s4:samdb: Add test_gnutls_value_decryption()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-08-21 09:57:29 +00:00
Marco Wang
1b599e5c0d s3: net: net_ads: fix a typo in comment
Signed-off-by: Marco Wang <m.aesophor@gmail.com>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Aug 21 08:39:43 UTC 2019 on sn-devel-184
2019-08-21 08:39:43 +00:00
Swen Schillig
fc4ad5b6df talloc: ASAN fix for test_magic_protection
Direct leak of 1152 byte(s) in 1 object(s) allocated from:
     #0 0x7f06393dfc08 in __interceptor_malloc (/lib64/libasan.so.5+0xefc08)
     #1 0x7f06392cfd59 in __talloc_with_prefix ../../talloc.c:782
     #2 0x7f06392cfd59 in _talloc_pool ../../talloc.c:837
     #3 0x7f06392cfd59 in talloc_pool ../../talloc.c:859
     #4 0x40b83c in test_magic_protection ../../testsuite.c:1960
     #5 0x40b83c in torture_local_talloc ../../testsuite.c:2164
     #6 0x402603 in main ../../testsuite_main.c:32
     #7 0x7f063908a412 in __libc_start_main (/lib64/libc.so.6+0x24412)

Signed-off-by: Swen Schillig <swen@linux.ibm.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Matthias Dieter Wallnöfer <mdw@samba.org>
2019-08-21 07:20:39 +00:00
Swen Schillig
d0933ec62c talloc: ASAN fix for test_rusty
Direct leak of 100 byte(s) in 1 object(s) allocated from:
     #0 0x7f06393dfc08 in __interceptor_malloc (/lib64/libasan.so.5+0xefc08)
     #1 0x7f06392d1af3 in __talloc_with_prefix ../../talloc.c:782
     #2 0x7f06392d1af3 in __talloc ../../talloc.c:824
     #3 0x7f06392d1af3 in __talloc_strlendup ../../talloc.c:2455
     #4 0x7f06392d1af3 in talloc_strdup ../../talloc.c:2471
     #5 0x40b4f0 in test_rusty ../../testsuite.c:1543
     #6 0x40b4f0 in torture_local_talloc ../../testsuite.c:2146
     #7 0x402603 in main ../../testsuite_main.c:32
     #8 0x7f063908a412 in __libc_start_main (/lib64/libc.so.6+0x24412)

Signed-off-by: Swen Schillig <swen@linux.ibm.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Matthias Dieter Wallnöfer <mdw@samba.org>
2019-08-21 07:20:39 +00:00
Swen Schillig
6c3e8a0a9f talloc: ASAN fix for test_pool_nest
Direct leak of 96 byte(s) in 1 object(s) allocated from:
    #0 0x7f06393dfc08 in __interceptor_malloc (/lib64/libasan.so.5+0xefc08)
    #1 0x7f06392d0c45 in __talloc_with_prefix ../../talloc.c:782
    #2 0x7f06392d0c45 in __talloc ../../talloc.c:824
    #3 0x7f06392d0c45 in _talloc_named_const ../../talloc.c:981
    #4 0x7f06392d0c45 in talloc_named_const ../../talloc.c:1748
    #5 0x40901e in test_pool_nest ../../testsuite.c:1451
    #6 0x40901e in torture_local_talloc ../../testsuite.c:2096
    #7 0x402603 in main ../../testsuite_main.c:32
    #8 0x7f063908a412 in __libc_start_main (/lib64/libc.so.6+0x24412)

Signed-off-by: Swen Schillig <swen@linux.ibm.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Matthias Dieter Wallnöfer <mdw@samba.org>
2019-08-21 07:20:39 +00:00
Swen Schillig
878e804df6 talloc: ASAN fix for test_talloc_free_in_destructor
Indirect leak of 104 byte(s) in 1 object(s) allocated from:
    #0 0x7f06393dfc08 in __interceptor_malloc (/lib64/libasan.so.5+0xefc08)
    #1 0x7f06392d0c45 in __talloc_with_prefix ../../talloc.c:782
    #2 0x7f06392d0c45 in __talloc ../../talloc.c:824
    #3 0x7f06392d0c45 in _talloc_named_const ../../talloc.c:981
    #4 0x7f06392d0c45 in talloc_named_const ../../talloc.c:1748
    #5 0x409edd in test_talloc_free_in_destructor ../../testsuite.c:1256
    #6 0x409edd in torture_local_talloc ../../testsuite.c:2138
    #7 0x402603 in main ../../testsuite_main.c:32
    #8 0x7f063908a412 in __libc_start_main (/lib64/libc.so.6+0x24412)

Signed-off-by: Swen Schillig <swen@linux.ibm.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Matthias Dieter Wallnöfer <mdw@samba.org>
2019-08-21 07:20:39 +00:00
Swen Schillig
616646a0c4 talloc: ASAN fix for test_realloc_on_destructor_parent
Direct leak of 96 byte(s) in 1 object(s) allocated from:
    #0 0x7fd52c00dc08 in __interceptor_malloc (/lib64/libasan.so.5+0xefc08)
    #1 0x7fd52befec45 in __talloc_with_prefix ../../talloc.c:782
    #2 0x7fd52befec45 in __talloc ../../talloc.c:824
    #3 0x7fd52befec45 in _talloc_named_const ../../talloc.c:981
    #4 0x7fd52befec45 in talloc_named_const ../../talloc.c:1748
    #5 0x4099bd in test_realloc_on_destructor_parent ../../testsuite.c:1000
    #6 0x4099bd in torture_local_talloc ../../testsuite.c:2129
    #7 0x402603 in main ../../testsuite_main.c:32
    #8 0x7fd52bcb8412 in __libc_start_main (/lib64/libc.so.6+0x24412)

Signed-off-by: Swen Schillig <swen@linux.ibm.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Matthias Dieter Wallnöfer <mdw@samba.org>
2019-08-21 07:20:39 +00:00
Jeremy Allison
f42642e54e s3: VFS: Complete the replacement of SMB_VFS_LINK() -> SMB_VFS_LINKAT().
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Böhme <slow@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Aug 20 22:26:17 UTC 2019 on sn-devel-184
2019-08-20 22:26:17 +00:00
Jeremy Allison
fb75a3d5e9 s3: VFS: vfs_time_audit. Remove link_fn(). No longer used.
NB, this will now fail smb_vfs_assert_all_fns()
until we remove the rename_fn() from the VFS definitions.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Böhme <slow@samba.org>
2019-08-20 21:09:29 +00:00