1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-25 23:21:54 +03:00
Commit Graph

121043 Commits

Author SHA1 Message Date
Gary Lockyer
575d39048e idl: limit recurion on recursive elements
Limit the max_recursion on self recursive definitions in the idl to
20,000. This value is hopefully large eneough to not impact normal
operation, but small eneough to prevent stack over flow issues.

Credit to OSS-Fuzz

REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19820
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14254

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Thu Feb 27 02:29:21 UTC 2020 on sn-devel-184
2020-02-27 02:29:20 +00:00
Gary Lockyer
2ba2ce40f9 fuzzing: ndr set global_max_recursion.
Set global_max_recursion to 128, to ensure the fuzzer does not trip the
ASAN maximum stack depth which seems to be about 256?

Credit to OSS-Fuzz

REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19820
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14254

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-02-27 01:02:32 +00:00
Gary Lockyer
2f8c3b6226 idl: drsuapi_DsaAddressListItem_V1 limit recursion
Limit number of drsuapi_DsaAddressListItem_V1 elements to 1024

Credit to OSS-Fuzz

REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19820
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14254

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-02-27 01:02:32 +00:00
Gary Lockyer
5d323f2a2e pidl: Add recursive depth checks.
Add new parameter to elements "max_recursion" and modify pidl to call
NDR_RECURSION_CHECK and NDR_RECURSION_UNWIND for element tagged with
that attribute.

Credit to OSS-Fuzz

REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19820
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14254

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-02-27 01:02:32 +00:00
Gary Lockyer
ba518a1deb librpc ndr: add recursion check macros
Add macros to check the recursion depth.

Credit to OSS-Fuzz

REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19280
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14254

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-02-27 01:02:32 +00:00
Gary Lockyer
23d285d349 librpc ndr: Stack-overflow in ndr_pull_drsuapi_DsaAddressListItem_V1
Reproducer for oss-fuzz Issue 19280

Project: samba
Fuzzing Engine: libFuzzer
Fuzz Target: fuzz_ndr_drsuapi_TYPE_OUT
Job Type: libfuzzer_asan_samba
Platform Id: linux

Crash Type: Stack-overflow
Crash Address: 0x7ffcb4cc2ff8
Crash State:
  ndr_pull_drsuapi_DsaAddressListItem_V1

Sanitizer: address (ASAN)

Credit to OSS-Fuzz

REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19280
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14254

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-02-27 01:02:32 +00:00
Gary Lockyer
3e072b3fb7 build: fix the coverage build
"make lcov" was failing with:
   Processing file bin/default/<stdout>
   genhtml: ERROR: cannot read ... <stdout>

Flex adds "#line nnn <stdout>" to the generated source, which then causes
issues with lcov. This commit adds a SAMBA_GENERATOR for es_lexer.l and
sparql_lexer.l that strips out the offending lines.

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-02-27 01:02:32 +00:00
Stefan Metzmacher
340cd2b816 ldb: change the version to 2.2.0 for Samba 4.13
Signed-off-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Wed Feb 26 23:11:39 UTC 2020 on sn-devel-184
2020-02-26 23:11:39 +00:00
Stefan Metzmacher
4edece5e97 s3:smb2_tcon: pass down in_flags to smbd_smb2_tree_connect_send()
SMB 3.1.1 converted the reserved field to a flags field.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Wed Feb 26 21:11:59 UTC 2020 on sn-devel-184
2020-02-26 21:11:59 +00:00
Volker Lendecke
3a7480d612 s3:lib: Allow open_socket_out without a timeout
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-02-26 19:45:37 +00:00
Stefan Metzmacher
09ea7248e0 lib/async_req: remove useless "reentrant" support from async_connect_send()
Now that open_socket_out*() doesn't do the strange reentrant calls,
we can remove support for this in async_connect_send(), so that we'll
never get any new users of this.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-02-26 19:45:37 +00:00
Stefan Metzmacher
a26be7eeed s3:lib: avoid calling async_connect_send() again and again in open_socket_out*()
There's really no need to do that!

Once connect() is called and returned EINPROGRESS, the kernel
knowns what to do and reports any state change via
TEVENT_FD_READ or TEVENT_FD_WRITE.
The actual success or failure is available via
getsockopt(.., SOL_SOCKET, SO_ERROR, ...).

Before this commit we called connect() (via async_connect_send()) again
and again until we reached the final caller provided timeout,
even if the kernel already found out that the destination is
unreachable.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-02-26 19:45:36 +00:00
Stefan Metzmacher
d48fba7c09 s3:lib: avoid goto's in open_socket_out_send()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-02-26 19:45:36 +00:00
Stefan Metzmacher
ce1a3f2cb2 s3:lib: s/result/req in open_socket_out_send()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-02-26 19:45:36 +00:00
Stefan Metzmacher
048a4230b2 lib/async_req: make sure we return errors early from async_connect_send/recv
While it is true that [e]poll() only needs POLLOUT
and POLLERR/POLLHUP are added implicitly.
For tevent we need TEVENT_FD_READ in order to see POLLERR/POLLHUP.

The socket becomes only readable when we hit an error.
Waiting for TEVENT_FD_WRITE is needed for getting success,
while TEVENT_FD_READ is required to get failures.

This matches what we have in tstream_bsd_connect_send().

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-02-26 19:45:36 +00:00
Stefan Metzmacher
6d63fa0246 lib/tsocket: add a comment regarding TEVENT_FD_READ in tstream_bsd_connect_send()
This is different compared to the raw usage of [e]poll
where [E]POLLOUT is enough to see errors via POLLERR/POLLHUP.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-02-26 19:45:36 +00:00
Stefan Metzmacher
aab5c8470f s3:wscript: split out dsgetdcname subsystem
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-02-26 19:45:36 +00:00
Stefan Metzmacher
f99d8ffcbf s3:wscript: move libsmb/clidgram.c to LIBNMB
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-02-26 19:45:36 +00:00
Stefan Metzmacher
b1ebfec39e s3:libsmb: move cli_set_message() to source3/libsmb/nmblib.c
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-02-26 19:45:36 +00:00
Stefan Metzmacher
03562cf128 s3:libsmb: use only a timeout of 250ms in name_resolve_bcast_send()
We use the same value for broadcasts in name_query().

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-02-26 19:45:36 +00:00
Stefan Metzmacher
08a7f5c47d s3:libsmb: pass dest_ss to cli_cm_open()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-02-26 19:45:36 +00:00
Stefan Metzmacher
e0c502728f s3:libsmb: pass dest_ss to cli_cm_connect() down to cli_connect_nb()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-02-26 19:45:36 +00:00
Volker Lendecke
c3242b4dfc libsmb: Fill in device which we don't get from cli_posix_stat
SMB1 unix extensions don't carry st_dev for stat

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14101

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Wed Feb 26 00:50:32 UTC 2020 on sn-devel-184
2020-02-26 00:50:32 +00:00
Volker Lendecke
51551e0d53 libsmb: Pass the correct path to cli_posix_stat()
This fixes doing strlen() on talloc_tos(), about which valgrind is pretty
unhappy. Without this patch we survive the tests because we have fallbacks to
the non-posix flavors of stat(). With this patch in place cli_posix_stat()
becomes functional in this code path. This creates conflicts with the readdir
libsmbclient tests, which need fixing separately.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14101

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-02-25 23:23:39 +00:00
Volker Lendecke
5076e28aec selftest: Slightly simplify setting up libsmbclient tests
We'll add per-test arguments soon

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Feb 25 19:30:27 UTC 2020 on sn-devel-184
2020-02-25 19:30:27 +00:00
Volker Lendecke
9df3ed7e12 selftest: We don't need an AD DC for libsmbclient tests
In case we would start to actually test kerberos auth via the libsmbclient API
(which we right now don't), this will change again. Until then,

make test TESTS=libsmbclient

is a lot faster this way.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-02-25 17:44:45 +00:00
Volker Lendecke
ae76d21834 selftest: Consolidate planning libsmbclient tests to source4
We don't need to plan those tests both in source3 and source4's
tests.py. The source4 version seems more "advanced", it uses
smbtorture4_testsuites() to list all tests, making it less
error-prone, and it also does the tests for all SMB1 and SMB3

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-02-25 17:44:45 +00:00
Volker Lendecke
8f50e4fa12 torture4: Use higher-level torture macros
Makes an easier read of torture_libsmbclient_readdirplus_seek()

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-02-25 17:44:45 +00:00
Volker Lendecke
b7b7fbf91b torture4: Use torture_assert_not_null where appropriate
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-02-25 17:44:45 +00:00
Volker Lendecke
15769f11a4 libsmb: Don't pass "sbuf" to cli_posix_stat_send()
Don't pass in the result buffer upon _send(), let the _recv() function
fill this in. Internal API only, adapt to current conventions.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-02-25 17:44:45 +00:00
Volker Lendecke
6d282d610f libsmb: Avoid casts
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-02-25 17:44:45 +00:00
Volker Lendecke
42f744d871 libsmb: Use IS[DOT]DOT
strequal is not necessary here

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-02-25 17:44:44 +00:00
Volker Lendecke
78eae77ec1 libsmb: Remove a pointless ZERO_STRUCT()
"c" is a pointer that was initialized to NULL above

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-02-25 17:44:44 +00:00
Volker Lendecke
d7281e3210 libsmb: Simplify callers of SMBC_dlist_contains()
This function already does the NULL check on the file pointer

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-02-25 17:44:44 +00:00
Volker Lendecke
427e10e8e3 libsmb: Make SMBC_dlist_contains return bool
It returned True/False, and is used as boolean only. Modernize
formatting a bit.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-02-25 17:44:44 +00:00
Volker Lendecke
c3a2cc9ba2 libsmb: Align calls to SMBC_dlist_contains()
Everywhere else it's called as !SMBC_dlist_contains()

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-02-25 17:44:44 +00:00
Volker Lendecke
a4a96a90bf libsmb: Add a NULL check
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-02-25 17:44:44 +00:00
Ralph Boehme
a23f8d913f VFS: default: add support for FILE_ATTRIBUTE_OFFLINE to async dosmode
This had been missing in the initial async dosmode implementation. It's the
responsibility of the sync and async dosmode functions to call
vfswrap_is_offline() since the offline functionality has been converted from a
first class VFS function to be a part of the DOS attributes VFS functions.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14293

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-02-25 17:44:44 +00:00
Ralph Boehme
ace296b976 VFS: default: use correct type for pathlen in vfswrap_getxattrat_do_sync()
full_path_tos() returns a ssize_t.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14293

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-02-25 17:44:44 +00:00
Ralph Boehme
cbca811212 VFS: default: avoid a crash in vfswrap_getxattrat_do_sync()
Must use tevent_req_data() to get our tevent_req state, talloc_get_type_abort()
will just crash as struct tevent_req != struct vfswrap_getxattrat_state.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14293

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-02-25 17:44:44 +00:00
Ralph Boehme
99873724cd VFS: default: remove unused arg from vfswrap_is_offline()
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14293

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-02-25 17:44:44 +00:00
Ralph Boehme
d4c69d82bd VFS: default: let vfswrap_is_offline() take conn, not handle
vfswrap_is_offline() has been converted to a "helper" function some time ago, it
had been a VFS interface function before. To make this change more obvious let
it take a struct connection_struct instead of a struct vfs_handle_struct which
is the canonical first parameter to VFS functions.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14293

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-02-25 17:44:44 +00:00
Stefan Metzmacher
0ca46a3726 ldb: version 2.1.1
* Bug 14270:
  Samba 4.11 and later give incorrect results for SCOPE_ONE searches

Signed-off-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(master): Tue Feb 25 12:59:02 UTC 2020 on sn-devel-184
2020-02-25 12:59:02 +00:00
Andrew Bartlett
0b8ab02008 ldb: Add tests aimed at the SCOPE_ONELEVEL bug in particular
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14270

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2020-02-25 10:38:34 +00:00
Andrew Bartlett
3c7261c43d ldb: Fix search with scope ONE and small result sets
This changes the LDB behaviour in the combination of a SCOPE_ONE search and
an index returning less than 10 results.

After b6b5b5fe35 the list->strict flag
became set to false in all cases, rather than being left to the
value set by the caller.

This changes the ldb_kv_index_dn_one() code to force strict
mode on success instead.

Thanks to Marcus Granér, ICEYE Oy for reporting.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14270

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2020-02-25 10:38:34 +00:00
Andrew Bartlett
ec34a70957 ldb: Ensure @IDXONE modes is tested in ldb.python (apy.py) tests
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2020-02-25 10:38:34 +00:00
Andrew Bartlett
167676973b ldb: Add tests aimed at the SCOPE_ONELEVEL particular
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14270

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2020-02-25 10:38:34 +00:00
Andrew Bartlett
17bd63dbea ldb: Add tests for one-level indexes in conjunction with other indexes
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14270

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2020-02-25 10:38:34 +00:00
Andreas Schneider
a2692b6494 lib:util: Add (PULL|PUSH)_(BE|LE)_I(8|16|32|64) byterarray macros
The only difference is that the pull macros do the correct casting of
the integer in the end.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Fri Feb 21 03:35:58 UTC 2020 on sn-devel-184
2020-02-21 03:35:58 +00:00
Andreas Schneider
a84c24e71d lib:util: Do not expose internal header files
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-02-21 02:09:34 +00:00