1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-25 23:21:54 +03:00
Commit Graph

107019 Commits

Author SHA1 Message Date
Jeremy Allison
592e7fa67b CVE-2017-2619: s3: smbd: Move special handling of symlink errno's into a utility function.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12496

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2017-03-23 19:10:19 +01:00
Jeremy Allison
6ff5f0a75a CVE-2017-2619: s3: smbd: Remove O_NOFOLLOW guards. We insist on O_NOFOLLOW existing.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12496

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2017-03-23 19:10:19 +01:00
Jeremy Allison
49ed0b01d1 CVE-2017-2619: s3: smbd: Correctly fallback to open_dir_safely if FDOPENDIR not supported on system.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12496

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2017-03-23 19:10:19 +01:00
Jeremy Allison
f6dfdf7d31 CVE-2017-2619: s3: smbd: Move the reference counting and destructor setup to just before retuning success.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12496

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2017-03-23 19:10:19 +01:00
Jeremy Allison
e68e73b8d3 CVE-2017-2619: s3: smbd: OpenDir_fsp() - Fix memory leak on error.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12496

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2017-03-23 19:10:19 +01:00
Jeremy Allison
86f15237a1 CVE-2017-2619: s3: smbd: OpenDir_fsp() use early returns.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12496

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2017-03-23 19:10:19 +01:00
Jeremy Allison
05a9898dda CVE-2017-2619: s3: smbd: Create and use open_dir_safely(). Use from OpenDir().
Hardens OpenDir against TOC/TOU races.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12496

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2017-03-23 19:10:19 +01:00
Jeremy Allison
682d597ee3 CVE-2017-2619: s3: smbd: Opendir_internal() early return if SMB_VFS_OPENDIR failed.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12496

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2017-03-23 19:10:19 +01:00
Jeremy Allison
3461518027 CVE-2017-2619: s3: smbd: Create wrapper function for OpenDir in preparation for making robust.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12496

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2017-03-23 19:10:19 +01:00
Ralph Boehme
0a982be89f CVE-2017-2619: s4/torture: add SMB2_FIND tests with SMB2_CONTINUE_FLAG_REOPEN flag
Bug: https://bugzilla.samba.org/show_bug.cgi?id=12496

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2017-03-23 19:10:19 +01:00
Ralph Boehme
47b6b6f8f5 CVE-2017-2619: s3/smbd: re-open directory after dptr_CloseDir()
dptr_CloseDir() will close and invalidate the fsp's file descriptor, we
have to reopen it.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12496

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2017-03-23 19:10:19 +01:00
Stefan Metzmacher
1e0df575bc libwbclient: add WBC_SID_NAME_LABEL
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Thu Mar 23 12:55:26 CET 2017 on sn-devel-144
2017-03-23 12:55:26 +01:00
Stefan Metzmacher
ac2622ee86 libcli/security: add SID_NAME_LABEL to sid_type_lookup()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2017-03-23 09:01:21 +01:00
Stefan Metzmacher
1161e11d48 lsa.idl: add SID_NAME_LABEL
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2017-03-23 09:01:21 +01:00
Stefan Metzmacher
3a5d76f092 netlogon.idl: make netr_LogonInfoClass public
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2017-03-23 09:01:21 +01:00
Volker Lendecke
2901fe8921 net: Don't crash if lsa_LookupPrivDisplayName returns NULL
lsa_LookupPrivDisplayName on Windows 2012R2 can return success and still return
a NULL name:

rpc_api_pipe: got frag len of 36 at offset 0: NT_STATUS_OK
rpc_api_pipe: host 172.18.103.80 returned 12 bytes.
     lsa_LookupPrivDisplayName: struct lsa_LookupPrivDisplayName
        out: struct lsa_LookupPrivDisplayName
            disp_name                : *
                disp_name                : NULL
            returned_language_id     : *
                returned_language_id     : 0x0000 (0)
            result                   : NT_STATUS_OK

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Mar 23 07:43:57 CET 2017 on sn-devel-144
2017-03-23 07:43:57 +01:00
Andreas Schneider
e7d1d8c493 nsswtich: Add negative tests for authentication with wbinfo
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12708

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>

Autobuild-User(master): Uri Simchoni <uri@samba.org>
Autobuild-Date(master): Wed Mar 22 10:58:58 CET 2017 on sn-devel-144
2017-03-22 10:58:58 +01:00
Andreas Schneider
e2028837b9 s3:libads: Remove obsolete smb_krb5_get_ntstatus_from_init_creds()
There is no way we can get a better error code out of this. The original
function called was krb5_get_init_creds_opt_get_error() which has been
deprecated in 2008.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12708

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2017-03-22 07:11:10 +01:00
Volker Lendecke
21fbbfded1 idmap_rfc2307: Clarify the documentation a bit
"bind_path" is a variable name internally used inside Samba. If you
look at "man ldapsearch" from OpenLDAP for example, the more common
term for this parameter is "search base". Adapt the documentation
accordingly.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2017-03-22 07:11:10 +01:00
Volker Lendecke
d8a063b4e6 idmap_rfc2307: Slightly simplify idmap_rfc2307_initialize()
Replace an "else" branch with an early "goto err"

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2017-03-22 07:11:10 +01:00
Volker Lendecke
7ff3ae7374 idmap_tdb: Avoid a few casts
The times of attempting to be C++ compatible are gone since C compilers
can do very good warnings too.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2017-03-22 07:11:10 +01:00
Andreas Schneider
c0e196b223 s3:libsmb: Only print error message if kerberos use is forced
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12704

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Tue Mar 21 14:25:54 CET 2017 on sn-devel-144
2017-03-21 14:25:54 +01:00
Martin Schwenke
05b5af4ae5 autobuild: Stop waf uninstall from removing test_tmpdir
Most of the autobuild tasks run "make distcheck", which does a
recursive "waf configure make install uninstall".  "waf uninstall"
(via BuildContext.install() in Build.py) removes empty directories all
the way up the directory tree.  This means that it removes
test_tmpdir, if it is empty, and any empty directories above it.

While this is arguably a waf bug, the simplest solution is to make
test_tmpdir non-empty so it don't get removed.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12703

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Tue Mar 21 10:37:08 CET 2017 on sn-devel-144
2017-03-21 10:37:08 +01:00
Volker Lendecke
55546fe458 idmap_autorid: Use idmap_config_int
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>

Autobuild-User(master): Michael Adam <obnox@samba.org>
Autobuild-Date(master): Mon Mar 20 23:28:38 CET 2017 on sn-devel-144
2017-03-20 23:28:37 +01:00
Volker Lendecke
adbabd3f4c idmap_rid: Use idmap_config_int
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2017-03-20 19:36:22 +01:00
Volker Lendecke
e190eaa30f winbind: Add idmap_config_int
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2017-03-20 19:36:22 +01:00
Volker Lendecke
0b05785de6 idmap_autorid: Use idmap_config_bool
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2017-03-20 19:36:22 +01:00
Volker Lendecke
b6b04b6bd7 idmap_ad: Use idmap_config_bool
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2017-03-20 19:36:22 +01:00
Volker Lendecke
3e72603c1f idmap_rfc2307: Use idmap_config_bool
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2017-03-20 19:36:22 +01:00
Volker Lendecke
cdaec3be3a idmap: Use idmap_config_bool in idmap_init_domain
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2017-03-20 19:36:22 +01:00
Volker Lendecke
66f5e7dbda winbind: Add idmap_config_bool()
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2017-03-20 19:36:21 +01:00
Volker Lendecke
644a997144 idmap_ad: Use idmap_config_const_string
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2017-03-20 19:36:21 +01:00
Volker Lendecke
b0edb06892 idmap_rfc2307: Use idmap_config_const_string
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2017-03-20 19:36:21 +01:00
Volker Lendecke
166e8fb1c1 idmap_ldap: Use idmap_config_const_string
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2017-03-20 19:36:21 +01:00
Volker Lendecke
c0bea5d081 idmap_ldap: Use idmap_config_const_string
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2017-03-20 19:36:21 +01:00
Volker Lendecke
9d22e8a99c winbind: Use idmap_config_const_string in idmap_init_domain
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2017-03-20 19:36:21 +01:00
Volker Lendecke
e78d78a1ff winbind: Use idmap_config_const_string in idmap_script_db_init
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2017-03-20 19:36:21 +01:00
Volker Lendecke
925335a5d4 winbind: Use idmap_config_const_string in idmap_tdb2_db_init
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2017-03-20 19:36:21 +01:00
Volker Lendecke
6d33ebd580 winbind: Use idmap_config_const_string in wb_xids2sids_add_dom
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2017-03-20 19:36:21 +01:00
Volker Lendecke
3f4b391daf winbind: Use idmap_config_const_string in idmap_init_named_domain
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2017-03-20 19:36:21 +01:00
Volker Lendecke
b8e00f0183 winbind: Use idmap_config_const_string in domain_has_idmap_config
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2017-03-20 19:36:21 +01:00
Volker Lendecke
1c34166c12 winbind: Add idmap_config_const_string
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2017-03-20 19:36:21 +01:00
Volker Lendecke
a181609f94 lib: Simplify smb_nanosleep
We have the recalculation logic also in sys_poll_intr, don't duplicate it.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Mon Mar 20 16:11:16 CET 2017 on sn-devel-144
2017-03-20 16:11:15 +01:00
Volker Lendecke
8f0ecb660e lib: Make sys_poll_intr available to ctdb
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2017-03-20 12:20:08 +01:00
Volker Lendecke
0b6156f8da lib: Avoid an includes.h
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2017-03-20 12:20:08 +01:00
Martin Schwenke
e78b887531 ctdb-tests: Catch cases where mktemp fails due to missing TMPDIR
TMPDIR sometimes goes missing during autobuild.  When that happens the
error messages produced by CTDB tests are not very helpful.  This
should make it clear.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

Autobuild-User(master): Amitay Isaacs <amitay@samba.org>
Autobuild-Date(master): Mon Mar 20 08:53:02 CET 2017 on sn-devel-144
2017-03-20 08:53:01 +01:00
Volker Lendecke
ece5e67bbc s3:winbind: Use the correct talloc context for user information
This fixes the substitution for 'template homedir'.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12699

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Sat Mar 18 19:47:40 CET 2017 on sn-devel-144
2017-03-18 19:47:40 +01:00
Andreas Schneider
f2e1ab5d05 s3:winbind: Remove unused struct getpwent_user
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Sat Mar 18 08:59:01 CET 2017 on sn-devel-144
2017-03-18 08:59:01 +01:00
Andreas Schneider
3605f68cea s3:winbind: Use correct struct member for size calculation
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2017-03-18 05:05:24 +01:00
Volker Lendecke
649deb63c5 tldap: Allow dropping messages in tldap_search()
For probing whether a connection is a live a rootdse search might be
interesting where we don't really care for the result, only success or
failure of the operation.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2017-03-18 05:05:24 +01:00