1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-24 21:34:56 +03:00
Commit Graph

4899 Commits

Author SHA1 Message Date
Volker Lendecke
3a0047eaf1 dsdb: Fix CID 1453464: Error handling issues (CHECKED_RETURN)
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-09-04 17:03:33 +00:00
Volker Lendecke
09946c558f dsdb: Fix CID 1453465: Null pointer dereferences (NULL_RETURNS)
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-09-04 17:03:33 +00:00
Andrew Bartlett
2972981882 dsdb: Remove unused local_password module
This was an idea about how Samba might have worked if passwords were
not safe to be stored in a remote DB (get some kind of LDAP backend).

Nothing ever used this, but it was a nice idea.  But git master is not
the place to preserve history, even interesting ideas like splitting
passwords from the non-password data (possible because, in the same way
we are allowed to encrypt them, we do not allow a search on password
values).

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2019-09-01 23:55:39 +00:00
Andrew Bartlett
72201055f5 dsdb: Remove unused simple_dn module
This became unused with 2b0fc74a09 that
removed the last of the support for the LDAP Backend

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2019-09-01 23:55:38 +00:00
Andrew Bartlett
af6799bf4f util: Remove unused NS_GUID_string() and NS_GUID_from_string()
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14063
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2019-09-01 23:55:38 +00:00
Andrew Bartlett
cf3977585d dsdb: Remove unused entryuuid and nsuniqueid modules
These were for the now removed OpenLDAP backend.  Any future work in this area will
not involve this kind of translation, it will be done much more cleanly.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2019-09-01 23:55:38 +00:00
Mathieu Parent
549a4a82e0 Spelling fixes s/preceeding/preceding/
Signed-off-by: Mathieu Parent <math.parent@gmail.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2019-09-01 22:21:28 +00:00
Mathieu Parent
105bb06318 Spelling fixes s/withing/within/
Signed-off-by: Mathieu Parent <math.parent@gmail.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2019-09-01 22:21:28 +00:00
Mathieu Parent
d9b50ce7df Spelling fixes s/recieved/received/
Signed-off-by: Mathieu Parent <math.parent@gmail.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2019-09-01 22:21:27 +00:00
Mathieu Parent
a03bafbcd5 Spelling fixes s/overriden/overridden/
Signed-off-by: Mathieu Parent <math.parent@gmail.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2019-09-01 22:21:26 +00:00
Andrew Bartlett
2b0fc74a09 dsdb: Remove OpenLDAP backend complexity from samba_dsdb module
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Nadezhda Ivanova <nivanova@symas.com>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Fri Aug 30 09:50:25 UTC 2019 on sn-devel-184
2019-08-30 09:50:25 +00:00
Andrew Bartlett
3da41b51b0 dsdb: Remove OpenLDAP backend complexity from partitions module
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Nadezhda Ivanova <nivanova@symas.com>
2019-08-30 08:32:30 +00:00
Andrew Bartlett
6d1fe28411 dsdb: Remove LDAP backend specific modules from extended_dn_out
This simplifies the code considerably.  A real attempt at an LDAP backend would need to implement this
module in a similar way to LDB.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Nadezhda Ivanova <nivanova@symas.com>
2019-08-30 08:32:30 +00:00
Aaron Haslett
b5b6b74b82 paged results: tests without server_sort ctrl
On windows, adding or modifying a record during a paged results search
behaves differently depending on whether or not you supply server_sort
control.  This patch adds tests and documentation.

Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Fri Aug 30 08:26:21 UTC 2019 on sn-devel-184
2019-08-30 08:26:21 +00:00
Andrew Bartlett
b4816861f2 s4-dns: Deprecate BIND9_FLATFILE and remove "rndc command"
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Thu Aug 22 21:24:00 UTC 2019 on sn-devel-184
2019-08-22 21:24:00 +00:00
Andrew Bartlett
85a1c49739 s4-samdb: Remove duplicate encrypted_secrets code using internal Samba AES
We now rely on GnuTLS 3.4.7 or later.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2019-08-21 09:57:31 +00:00
Andreas Schneider
d46e538d52 s4:samdb: Only include necessary header files in encrypted_secrets
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-08-21 09:57:29 +00:00
Andreas Schneider
7bf3c5d764 s4:samdb: Remove dual-stack mode from (test_)encrypted_secrets
Now we either build with GnuTLS or Samba crypto. If a modern GnuTLS
version is detected that will be used and Samba crypto wont be
available.

This removes the dual-stack mode that encrypted with one and decrypted
with the other in the testsuite.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Commit message clarified by Andrew Bartlett

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2019-08-21 09:57:29 +00:00
Andrew Bartlett
92b9cdf99d encrypted_secrets: Add known and expected value test
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2019-08-21 09:57:29 +00:00
Andreas Schneider
feccdebe15 s4:samdb: Add test_gnutls_value_decryption()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-08-21 09:57:29 +00:00
Andreas Schneider
a3e36dd8f4 s4:samdb: Use generate_nonce_buffer() for AEC GCM nonce
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
2019-08-14 15:07:24 +00:00
Volker Lendecke
d8ae281152 dsdb: Fix the FreeBSD build
My FreeBSD install does not have __compar_fn_t. libreplace has the
QSORT_CAST for systems that do.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-08-06 21:49:28 +00:00
Andrew Bartlett
1a7f2a230d dsdb: Quiet CID 1452117 1452119 1452114 (STRAY_SEMICOLON)
Try to make clear what is being done here, we are trying to count the partitions so that
we can then walk them in reverse.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2019-08-01 05:01:15 +00:00
Douglas Bagnall
0c001a7bf6 CID 1452121: dsdb/mod/partition: protect whole function with NULL check
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Jul 31 04:08:48 UTC 2019 on sn-devel-184
2019-07-31 04:08:48 +00:00
Douglas Bagnall
a5ec857abe CID 1452109: dsdb/util: do not check for NULL after deref
This is all strictly unnecessary, as ret is always != LDB_SUCCESS when
res is NULL, but we want to make peace between clang and converity.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-07-31 02:50:24 +00:00
Douglas Bagnall
e77237bb46 s4/dsdb/replmd: use incoming_dn_should_be_renamed() 2/2
In replmd_replicated_handle_rename().

The helper function was introduced two commits ago and consists of
a large common stretch of this and the function modified in the previous
commit.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Jul 24 11:21:50 UTC 2019 on sn-devel-184
2019-07-24 11:21:50 +00:00
Douglas Bagnall
b9dab848de s4/dsdb/replmd: use incoming_dn_should_be_renamed() 1/2
In replmd_op_possible_conflict_callback().

The helper function was introduced in the previous commit and consists
of a large common stretch of this and replmd_replicated_handle_rename().

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-07-24 09:35:24 +00:00
Douglas Bagnall
5d75ab3ebf s4/dsdb/replmd: add a helper for common calculations
We currently do exactly this work, in exactly these words (ignoring
formatting) in two different places. The next two commits will make
those places use this helper function. We do this over three commits
so that we can more easily compare the next two and be sure they are
doing the same thing.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-07-24 09:35:24 +00:00
Douglas Bagnall
e7a6c70953 s4/dsdb/replmd: replicated_handle_rename free temp_ctx
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-07-24 09:35:24 +00:00
Aaron Haslett
6c691bf84e partition: reversing partition unlocking
Unlock partition databases in the reverse order from which they were
acquired. This is separated from the previous commit for future
bisecting purposes, since the last commit was made to fix specific CI
failures, while this one is a speculative fix made based on code
inspection.

Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-07-24 05:50:23 +00:00
Aaron Haslett
7f4bc0ea81 partition: correcting lock ordering
A schema reading bug was traced to a lock ordering issue in partition.c.
This patch fixes the problem by:
1. Releasing locks/transactions in the order they were acquired.
2. Always lock/start_trans on metadata.tdb first, before any other
databases, and release it last, after all others. This is so that we are
never exposed to MDB's lock semantics, which we don't support.

Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-07-24 05:50:23 +00:00
Noel Power
54af94ff21 s4/source4/common: clang: Fix 'Dereference of undefined pointer value'
Fixes:

source4/dsdb/common/util.c:3131:6: warning: Dereference of undefined pointer value <--[clang]
        if (res->count < 1) {
            ^

/source4/dsdb/common/util.c:3207:6: warning: Dereference of undefined pointer value <--[clang]
        if (res->count < 1) {
            ^~~~~~~~~~
source4/dsdb/common/util.c:4004:39: warning: Dereference of undefined pointer value <--[clang]
        (*wkguid_dn) = talloc_steal(mem_ctx, res->msgs[0]->dn);
                                             ^
source4/dsdb/common/util.c:4191:35: warning: Dereference of undefined pointer value <--[clang]
        ouv_value = ldb_msg_find_ldb_val(r->msgs[0], "replUpToDateVector");

source4/dsdb/common/util.c:5757:13: warning: 1st function call argument is an uninitialized value <--[clang]
        same_nc = (ldb_dn_compare(source_nc, target_nc) == 0);
                   ^
This fix also fixes the associated 'Access to field 'xyx' results in a
dereference of a null pointer' warnings that also will happen when this
is fixed

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>

Autobuild-User(master): Gary Lockyer <gary@samba.org>
Autobuild-Date(master): Wed Jul 24 05:49:14 UTC 2019 on sn-devel-184
2019-07-24 05:49:14 +00:00
Noel Power
c7c40e205d s4/dsdb/common: clang: Fix 'Value stored to 'cps_stdin' is never read'
Fixes:

source4/dsdb/common/util.c:2125:4: warning: Value stored to 'cps_stdin' is never read <--[clang]
                        cps_stdin = -1;

                        ^           ~~
source4/dsdb/common/util.c:2132:3: warning: Value stored to 'cps_stdin' is never read <--[clang]
                cps_stdin = -1;

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2019-07-24 04:19:27 +00:00
Noel Power
55f18757aa s4/dsdb/common: clang: Fix 'Access results in a deref of a null pointer'
Fixes:

source4/dsdb/common/util.c:2000:6: warning: Access to field 'count' results in a dereference of a null pointer (loaded from variable 'res') <--[clang]
        if (res->count != 1) {
            ^~~

source4/dsdb/common/util.c:3281:28: warning: Access to field 'msgs' results in a dereference of a null pointer (loaded from variable 'res') <--[clang]
        el = ldb_msg_find_element(res->msgs[0], attr);
                                  ^~~
source4/dsdb/common/util.c:3568:6: warning: Access to field 'count' results in a dereference of a null pointer (loaded from variable 'res') <--[clang]
        if (res->count != 1 || ret != LDB_SUCCESS) {
            ^~~

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2019-07-24 04:19:27 +00:00
Noel Power
bd86df913b s4/dsdb/common: clang: Fix 'The left operand of '&' is a garbage value'
Fixes:

source4/dsdb/common/util.c:1964:18: warning: The left operand of '&' is a garbage value <--[clang]
        return (options & DS_NTDSDSA_OPT_IS_GC) != 0;
                ~~~~~~~ ^

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2019-07-24 04:19:27 +00:00
Noel Power
79d585689e s4/dsdb/common: clang: Fix 'function call argument is an uninitialized value'
Fixes:

source4/dsdb/common/util.c:1804:8: warning: 3rd function call argument is an uninitialized value <--[clang]
        ret = samdb_reference_dn(ldb, mem_ctx, server_ref_dn, "rIDSetReferences", dn);

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2019-07-24 04:19:27 +00:00
Douglas Bagnall
5405f2ad7e s4/py_dsdb: avoid NULL deref in set_domain_sid()
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-07-22 22:20:25 +00:00
Aaron Haslett
ee2fe56ba0 drepl: memory leak fix
Fixes a memory leak where schema reference attached to ldb
instance is lost before it can be freed.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14042

Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>

Autobuild-User(master): Garming Sam <garming@samba.org>
Autobuild-Date(master): Wed Jul 17 06:17:10 UTC 2019 on sn-devel-184
2019-07-17 06:17:10 +00:00
Noel Power
c38a7745b1 s4/dsdb/common: clang: Fix access results in null pointer deref.
Fixes:

source4/dsdb/common/util_trusts.c:2915:21: warning: Access to field 'sid' results in a dereference of a null pointer (loaded from field 'tdo') <--[clang]
        d->di.domain_sid = d->tdo->sid;
                           ^  ~~~
1 warning generated.

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2019-07-11 04:08:13 +00:00
Douglas Bagnall
1d6b472cdc pyldb: rename pyldb_Dn_AsDn() to pyldb_Dn_AS_DN()
Following the python/C convention for checking vs non-checking
convertors.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2019-07-10 04:32:13 +00:00
Douglas Bagnall
e075f52a75 pyldb: fork pyldb_Ldb_AsLdbContext macro to reflect unsafeness
In the Python/C API, conversion functions which check the types of their arguments
have names like:

double PyFloat_AsDouble(PyObject *pyfloat);

while conversion macros that don't check have names like:

PyFloat_AS_DOUBLE(pyfloat)

The pyldb_Ldb_AsLdbContext() macro looks like one of the checking functions
but it actually isn't. This has fooled us more than once. Here we fork
the macro into two -- one which performs checks and keeps the camel
case, and one with a shouty name that keeps the check-free behaviour.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2019-07-10 04:32:13 +00:00
Gary Lockyer
063809bc96 dsdb repl_meta_data: Don't print ldif on error
Don't call ldb_ldif_message_redacted_string when linked_attr_modify
fails.  When joining a large domain this takes way to much time, in excess of 3
hours for a join on a 200k domain.

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Tim Beale <timbeale@catalyst.net.nz>

Autobuild-User(master): Gary Lockyer <gary@samba.org>
Autobuild-Date(master): Tue Jul  9 03:03:25 UTC 2019 on sn-devel-184
2019-07-09 03:03:25 +00:00
Noel Power
d54f9aaf81 s4/dsdb/schema: clang: Fix Array access results in null pointer deref
Fixes:
source4/dsdb/schema/schema_query.c:223:15: warning: Array access (from variable 'attr_list') results in a null pointer dereference <--[clang]
        attr_list[i] = NULL;
        ~~~~~~~~~    ^
1 warning generated.

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2019-07-08 09:30:10 +00:00
Noel Power
50a22849ce s4/dsdb/schema: Fix 'Value stored to 'ret' is never read'
Fixes:

source4/dsdb/schema/schema_set.c:274:3: warning: Value stored to 'ret' is never read <--[clang]
                ret = LDB_SUCCESS;
                ^     ~~~~~~~~~~~
source4/dsdb/schema/schema_set.c:327:3: warning: Value stored to 'ret' is never read <--[clang]
                ret = LDB_SUCCESS;
                ^     ~~~~~~~~~~~

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2019-07-08 09:30:10 +00:00
Noel Power
109b438181 s4/dsdb/schema: Fix Access to field results in deference of null pointer
Fixes:

source4/dsdb/schema/schema_info_attr.c:207:38: warning: Access to field 'revision' results in a dereference of a null pointer (loaded from variable 'schema_info') <--[clang]
        if (schema->schema_info->revision > schema_info->revision) {
                                            ^~~~~~~~~~~
1 warning generated.

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2019-07-08 09:30:10 +00:00
Gary Lockyer
7d17dbd10e s4 samdb: pass ldb options to ldb_module_connect_backend
Pass the ldb options into ldb_module_connect_backend, to ensure ldb
options such as "batch mode" and "transaction index cache size" get passed
through to the backend modules.

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-07-04 10:02:23 +00:00
Douglas Bagnall
a4cea294d3 s4/tests/dsdb_schema: not usefully executable as script
You could run the script, but it wouldn't do anything.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-07-02 04:21:36 +00:00
Tim Beale
98848142cd repl_md: Avoid dropping cross-partition links
Cross-partition links could still be dropped if GET_TGT was already
previously set for the replication.

This was due to a slight error in the order of logic. We never want to
ignore cross-partition links (regardless of whether the TARGETS_UPTODATE
/GET_TGT flag is set). We should only be returning early in the
GET_TGT case if the objects are both in the same partition.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14022
RN: When the AD domain contained a linked attribute that spanned
partitions, DRS replication could drop the link. This dropped link could
then result in subtle differences in behaviour between DCs, as some DCs
would have the link and others wouldn't. When this issue occurred, the
dropped link would be logged in a warning message:
 "<target-dn> is Unknown but up to date. Ignoring link from <source-dn>"
This issue would not always occur - it depended a lot on the database
contents. Typically, it would only potentially occur when joining a new
DC to the domain (doing an ldapcmp after the join would also highlight
the problem, if it occurred). This issue has now been resolved.

Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-07-02 04:21:36 +00:00
Swen Schillig
3bc973c602 source4: Update all consumers of strtoul_err(), strtoull_err() to new API
Signed-off-by: Swen Schillig <swen@linux.ibm.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Christof Schmitt <cs@samba.org>
2019-06-30 11:32:18 +00:00
Tim Beale
295bf73e9b dsdb: Handle DB corner-case where PSO container doesn't exist
A 2003 AD DB with functional level set to >= 2008 was non-functional
due to the PSO checks.

We already check the functional level is >= 2008 before checking for the
PSO container. However, users could change their functional level
without ensuring their DB conforms to the corresponding base schema.

The objectclass DSDB module should prevent the PSO container from ever
being deleted. So the only way we should be able to hit this case is
through upgrading the functional level (but not the underlying schema
objects). If so, log a low-priority message and continue without errors.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14008
RN: Previously, AD operations such as user authentication could fail
completely with the message 'Error 32 determining PSOs in system' logged
on the samba server. This problem would only affect a domain that was
created using a pre-2008 AD base schema and then had its functional
level manually raised to 2008 or greater. This issue has now been
resolved.

Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-06-26 04:12:33 +00:00
Andrew Bartlett
f178daa854 py3: Remove PyStr_AsString() compatability macro
We no longer need Samba to be py2/py3 compatible so we choose to return to the standard
function names.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Noel Power <noel.power@suse.com>
2019-06-24 17:24:27 +00:00
Andrew Bartlett
34f9a089d8 py3: Remove PyStr_FromString() compatability macro
We no longer need Samba to be py2/py3 compatible so we choose to return to the standard
function names.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Noel Power <noel.power@suse.com>
2019-06-24 17:24:27 +00:00
Douglas Bagnall
6aa5d1f684 CVE-2019-12436 dsdb/paged_results: ignore successful results without messages
So that we don't dereference result->msgs[0] when it doesn't exist.
This can happen when the object has changed in such a way that it no
longer matches the original search query.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13951

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(master): Wed Jun 19 08:16:39 UTC 2019 on sn-devel-184
2019-06-19 08:16:39 +00:00
Gary Lockyer
ae4461dce9 auth auth_log: csbuild unused parm unix_username
Fixes csbuild errors

Error: COMPILER_WARNING:
auth/auth_log.c: scope_hint: In function ‘log_authentication_event_json’
auth/auth_log.c:146:14: warning: unused parameter ‘unix_username’
[-Wunused-parameter]

Error: COMPILER_WARNING:
auth/auth_log.c: scope_hint: In function
‘log_authentication_event_human_readable’
auth/auth_log.c:586:14: warning: unused parameter ‘unix_username’
[-Wunused-parameter]

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>
2019-06-13 07:16:22 +00:00
Aaron Haslett
4eee09a2c1 dsdb: disable ORDERED_INTEGER with MDB pack format v1
For TDB databases, the new ORDERED_INTEGER type is disabled along with
repacking at format version 1 if GUID indexing is disabled, so all the new
database features are toggled together. This scheme doesn't work with
MDB because GUID indexing is mandatory when using MDB. However, a
downgrade path is still required so in a previous commit we added
a pack_format_override option which allows a downgrade script to force
the database to use an earlier packing format. But, the new
ORDERED_INTEGER type would still be present in MDB databases so this
patch reads the pack_format_override opaque and converts ORDERED_INTEGER
types in @ATTRIBUTES to INTEGER and doesn't write any indexes of that
type to @INDEXLIST. The @INDEXLIST will be refreshed later, on the first
transaction.

Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2019-05-29 04:41:25 +00:00
Aaron Haslett
08b9d204b6 ldb: binding ordered indexes to GUID indexing
To reduce the number of potential combinations of database features in
ldb, we want to link all new database features since 4.7. GUID indexing,
ordered integers, and pack format changes will all upgrade together.
This patch makes ordered integers only function if GUID indexing is
enabled. If GUID indexing is disabled, ORDERED_INTEGER will not be
written to @ATTRIBUTES and a syntax's index_format_fn will never be
used.

Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2019-05-29 04:41:24 +00:00
Stefan Metzmacher
706aba5bf6 dsdb:audit_log: avoid printing "... remote host [Unknown] SID [(NULL SID)] ..."
We better print "... remote host [Unknown] SID [S-1-5-18] ..."
in 'dsdb_audit' message, this matches what we print for
'dsdb_json_audit'.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13916

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2019-05-28 07:16:25 +00:00
Gary Lockyer
1958cd8a7f ldap server: generate correct referral schemes
Ensure that the referrals returned in a search request use the same
scheme as the request, i.e. referrals recieved via ldap are prefixed
with "ldap://" and those over ldaps are prefixed with "ldaps://"

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12478

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Fri May 24 05:12:14 UTC 2019 on sn-devel-184
2019-05-24 05:12:14 +00:00
Andrew Bartlett
e421c13bbc dsdb: Remove unsued dsdb_class_by_cn()
The callers moved to dsdb_class_by_cn_ldb_val() with
43aa546ecc in 2009.

Found by callcatcher

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2019-05-22 05:59:13 +00:00
Andreas Schneider
e6506ddec4 s4:dsdb: Use GnuTLS MD5 in password_hash module
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-05-21 00:03:22 +00:00
Andrew Bartlett
9822628749 selftest: Remove gensec.FEATURE_SEAL from samba4.ldap.notification
This made it much harder to watch under wireshark and is not required (no password setting).

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2019-05-20 04:01:11 +00:00
Andrew Bartlett
46185daeb2 dsdb: lock metadata.tdb during lock_read in partitions module
metadata.tdb was being locked during transactions, but not during read, and
we should ensure we take all our locks in order for consistency

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13950

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2019-05-20 04:01:10 +00:00
Andrew Bartlett
99867565a5 dsdb/partition: Remove teardown of data->metadata on partition_metadata_set_sequence_number() failure
This changes variables that are not the responsiblity of this function, the unlock
implied by partition_del_trans() needs to be done carefully in the right spot.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2019-05-20 04:01:10 +00:00
Andrew Bartlett
bc663a9798 dsdb/partition: Move in_transaction decrement to end of partition_del_trans()
It makes no sense for this to be mid-function.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2019-05-20 04:01:10 +00:00
Andrew Bartlett
7567f29211 dsdb/partition: Ensure metadata.tdb is opened early in partition_reload_if_required()
This allows metadata.tdb to be locked in the correct place in
in the lock order, as partition_reload_if_required() implicitly
calls partition_lock_read().

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2019-05-20 04:01:10 +00:00
Andrew Bartlett
46677b8e1e dsdb: Add random values to names in tests for large LDAP responses
This test is run agianst multiple DCs in the same domain, so there can
be a race with replication.  Therefore avoid using the same name twice
by adding a random suffix.

This is an improvement to a demonstrator for this bug in TDB:
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13952

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2019-05-20 04:01:10 +00:00
Andrew Bartlett
eafef2bbfd dsdb: Add tests for large LDAP responses
This behaviour is Samba-specific, we have not traditionally cut of responses at 1000
or so as Windows does, and we need to change that behaviour carefully.

This triggers this bug in TDB:
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13952

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-05-17 06:48:10 +00:00
Gary Lockyer
0daa0ff921 s4 dsdb/repl_meta_data: fix use after free in dsdb_audit_add_ldb_value
Fix use after free detected by AddressSanitizer

AddressSanitizer: heap-use-after-free on address 0x61400026a4a0
                  at pc 0x7fd555c52f12 bp 0x7ffed7231180 sp 0x7ffed7231170
                  READ of size 1 at 0x61400026a4a0 thread T0
    #0 0x7fd555c52f11 in ldb_should_b64_encode
       ../../lib/ldb/common/ldb_ldif.c:197
    #1 0x7fd539dc9417 in dsdb_audit_add_ldb_value
       ../../source4/dsdb/samdb/ldb_modules/audit_util.c:491
    #2 0x7fd539dc9417 in dsdb_audit_attributes_json
       ../../source4/dsdb/samdb/ldb_modules/audit_util.c:651
    #3 0x7fd539dc6a7e in operation_json
       ../../source4/dsdb/samdb/ldb_modules/audit_log.c:305

The problem is that at the successful end of these functions
el->values is overwritten with new_values.  However get_parsed_dns()
points p->v at the supplied el and it effectively gets used
as a working area by replmd_build_la_val().  So we must duplicate it
because our caller only called ldb_msg_copy_shallow().

The reason this matters is that the audit_log module is
above repl_meta_data in the stack, and tries to log the
ldb_message it saw after the reply (to include the error code).
If that ldb_message is changed it is not only misleading,
it can point to memory that has since gone away.

In this case the memory for the full extended DN in the
member attribute ended up on 'ac', a context lost by
the time repl_meta_data has finished processing.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13941

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed May 15 05:35:47 UTC 2019 on sn-devel-184
2019-05-15 05:35:47 +00:00
Andrew Bartlett
4aa9924310 s4 dsdb/repl_meta_data: allocate new extended DNs during ADD on a better context
Lower down in this function new_values is assigned over el->values and is
filled in with the values of all the parsed DNs.  Therefore it is the natural
talloc parent.

This will allow el->values to be allocated on tmp_ctx in the next commit for
a working area during the function call.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2019-05-15 04:03:37 +00:00
Gary Lockyer
b0cc6d2174 s4 dsdb: fix use after free in samldb_rename_search_base_callback
Fix use after free detected by AddressSanitizer

AddressSanitizer: heap-use-after-free on address 0x60f0002b2738
                  at pc 0x7f89b1a213b5 bp 0x7ffce9528810 sp 0x7ffce9528800
                  READ of size 8 at 0x60f0002b2738 thread T0
    #0 0x7f89b1a213b4 in samldb_rename_search_base_callback
        ../../source4/dsdb/samdb/ldb_modules/samldb.c:4203
    #1 0x7f89d3a0db4a in ldb_module_send_entry
        ../../lib/ldb/common/ldb_modules.c:793
    #2 0x7f89b6f27356 in es_callback
        ../../source4/dsdb/samdb/ldb_modules/encrypted_secrets.c:1418

Bug: https://bugzilla.samba.org/show_bug.cgi?id=13942

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-05-14 06:07:25 +00:00
Douglas Bagnall
93d6307185 dsdb mod/linked_attributes: fix_link_slow(): clarify a comment.
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-05-10 01:15:18 +00:00
Douglas Bagnall
9c254572dd dsdb/mod/extended_dn_out: use faster removal filters
When filtering out multiple elements, we end up memmove()ing the same
elements many times over. It is simpler to not do that by keeping track
of how many elements we are keeping.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-05-10 01:15:18 +00:00
Douglas Bagnall
4e47d5dfa2 dsdb/replmd: use ldb_msg_remove_element()
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-05-10 01:15:18 +00:00
Douglas Bagnall
14db307243 dsdb mods/extended_dn_out: remove element using ldb_msg api
The bare memmove is not strictly safe at the end of the list.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-05-10 01:15:17 +00:00
Douglas Bagnall
1e61b17106 dsdb/mod/extended_dn_out: zero whole fake_msg struct
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-05-10 01:15:17 +00:00
Douglas Bagnall
4624957d42 s4: use ldb_msg_new(), not talloc/talloc_zero
ldb_msg_new() is currently the same as talloc_zero(), but it might
not always be.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-05-10 01:15:17 +00:00
Douglas Bagnall
49048b245d dsdb/util: spell "equivalence"!
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-05-10 01:15:17 +00:00
Douglas Bagnall
79111dd0d0 dsdb/mod/count_attrs: set ldb var before using it (CID 1444979)
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>

Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org>
Autobuild-Date(master): Thu May  9 23:54:35 UTC 2019 on sn-devel-184
2019-05-09 23:54:35 +00:00
Douglas Bagnall
215eef5b6f s4/dsdb/util_samr: check some return codes (CID 1444977)
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2019-05-09 22:39:27 +00:00
Douglas Bagnall
b18f0dce38 dsdb/modules/linked_attrs: remove pointless check (CID 240768)
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2019-05-09 22:39:27 +00:00
Douglas Bagnall
23f72c4d71 dsdb/modules/dirsync: ensure attrs exist (CID 1107212)
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2019-05-09 22:39:27 +00:00
Douglas Bagnall
9a6c0a66d5 dsdb/modules/dirsync: remove useless function call
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2019-05-09 22:39:27 +00:00
Douglas Bagnall
2852dce541 dsdb/modules/dirsync: avoid possible NULL dereference (CID 1034800)
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2019-05-09 22:39:27 +00:00
Douglas Bagnall
8ad8f9baf0 dsdb/modules/acl: avoid deref of missing data (CID 1107200)
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2019-05-09 22:39:27 +00:00
Garming Sam
a497327042 CID 1363287: Resource leak using str_list_append
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2019-05-07 23:22:22 +00:00
Andrew Bartlett
e608a84fa4 torture: Remove unused dsdb_attribute_ldb_to_drsuapi()
The last caller was removed in s4-drs: GetNCChanges() to return correct (in AD-way) ATTIDs
(6a51afcfdb) by Kamen Mazdrashki in 2010

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2019-05-06 05:46:11 +00:00
Aaron Haslett
bc1583d368 selftest: correcting empty attribute usage in requests
Many parts of Samba use an empty attribute list in requests expecting
all attributes to be returned in the response, which is incorrect.  This
patch corrects the instances found by current CI tests.  Static analysis
and debugging will need to be done before changing ildap to the correct
semantics.

Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz>

Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Garming Sam <garming@samba.org>
Autobuild-Date(master): Mon May  6 05:45:55 UTC 2019 on sn-devel-184
2019-05-06 05:45:55 +00:00
Aaron Haslett
64bccb9bca ldap: test for empty attributes list
Test for LDAP request with an empty attribute list.  LDB responds with
no attributes, but LDAP responds with all attributes.  Fix is attached
to the bug below but we can't push it upstream until we've found all
instances of incorrect empty attribute list usage in Samba.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13852

Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-05-06 04:23:51 +00:00
Douglas Bagnall
60620273db dsdb/modules: a module to count attribute searches and results
The dsdb module stack can turn a simple search request into a
complicated tree of sub-queries that include attributes not originally
asked for and excluding those that were. The corresponding replies
might contain unrequested attributes or (for good reasons, according
to some module) hide requested ones. The entire stack is there to
meddle and that is what is does. Except *this* module. It just counts.
To understand dsdb performance it helps to have some idea what
requests and replies are flying too and fro. This module, when
inserted anywhere in the stack, counts the requests and replies
passing through and the attributes they contain. This data is stored
in on-disk tdbs in the private/debug directory.

The module is not loaded by default. To load it you need to patch the
source4/dsdb/samdb/ldb_modules/samba_dsdb.c and put "count_attrs"
somewhere in the module lists in the samba_dsdb_init() function. For
example, to examine the traffic between repl_meta_data and
group_audit_log, you would do something like this around line 316:

          "subtree_delete",
          "repl_meta_data",
  +       "count_attrs",
          "group_audit_log",
          "encrypted_secrets",

and recompile. Samba will then write to a number of tdb files in the
debug directory as requests and replies pass through. A simple script
is included to read these files. Doing this:

./script/attr_count_read st/ad_dc/private/debug/debug/attr_counts_not_found.tdb

will print a table showing how often various attritbutes were
requested but not found (from the point of view of the module).

A more sophisticated version of the script is coming in the next
commit, but this one is included first because in its simplicity it
documents the storage format reasonably well. The tdb keys are
attribute names, and the values are uint32_t in machine native order.

When the module is included in the stack there will be a very small
decrease in performance.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-05-01 05:32:25 +00:00
Douglas Bagnall
e5a099482d pytests: try ldap.modify_order with normal user
We run the tests again, trying to modify as a normal user rather than
Administrator.

It turns out that we do not always return the same error code as
Windows, but in all these tests both Windows and Samba always return
some kind of error (as you might hope).

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-05-01 05:32:25 +00:00
Douglas Bagnall
c73888ff6f dsdb pytests: test the effect of reordering modify requests
Do we interpret these the same way as Windows? In many cases, no.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-05-01 05:32:25 +00:00
Douglas Bagnall
fd9859d407 dsdb/pytest/ldap: use idiomatic 'e' for exceptions
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-05-01 05:32:25 +00:00
Douglas Bagnall
5a0df7aec6 dsdb/pytest/ldap: revive commented out test for attr size range
The test was presumably commented out because we fail it, and
known-failing it would have hidden the attr-too-short tests that it
was bundled with. If we disentangle them we can knwn-fail it, which
serves as a TODO list.

(passes against WIN2012R2).

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-05-01 05:32:25 +00:00
Andreas Schneider
2a5bf72b00 s4:samdb: Make sure value is initialized with 0
Found by csbuild.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed May  1 05:02:22 UTC 2019 on sn-devel-184
2019-05-01 05:02:22 +00:00
Douglas Bagnall
c5e387d22a s4/replmd delete: optimise attribute preservation with binary search
When we get here it is very likely that the attribute will not be
preserved, as the preserved ones should have had the flag set, but we
still end up loking through the whole list to confirm. With a binary
search, we end up looking at ~5 attributes to confirm.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-05-01 03:12:07 +00:00
Douglas Bagnall
8488651bdd s4/replmd: delete checks flag before laborious search
Most (perhaps all) attributes that are in the "must not remove" list also
have the PRESERVEONDELETE bit set, and checking bits is much cheaper
than a linear search involving strcasecmp. If we check the bit first
we save work.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-05-01 03:12:07 +00:00
Andreas Schneider
155f697e87 waf: Move check for gnutls_aead_cipher_init to main gnutls wscript
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-04-30 23:18:27 +00:00
Andreas Schneider
bbef26860d s4:dsdb: Use C99 initializer in dsdb util_trusts
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2019-04-29 16:04:28 +00:00
Swen Schillig
5ff48f64cd source4: Update error check for new string conversion wrapper
The new string conversion wrappers detect and flag errors
which occured during the string to integer conversion.
Those modifications required an update of the callees
error checks.

Signed-off-by: Swen Schillig <swen@linux.ibm.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Christof Schmitt <cs@samba.org>
2019-04-11 22:29:27 +00:00
Stefan Metzmacher
661dc45741 dsdb/repl: we need to replicate the whole schema before we can apply it
Otherwise we may not be able to construct a working schema that's
required to apply the changes.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12204

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2019-04-11 04:17:10 +00:00
Aaron Haslett
b7c1752754 dsdb:samdb: schemainfo update with relax control
Currently schema info's revision field isn't incremented if relax
control is present.  This is so that no increment is done during
provision, but we need the relax control in other situations where
the increment is desired, so we should use the provision control instead
to disable schema info update.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13799

Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2019-04-11 04:17:10 +00:00
Aaron Haslett
e34abefb77 samdb: test for schemainfo update with relax control
Currently schema info's revision field isn't incremented if relax
control is present.  This is so that no increment is done during
provision, but we need the relax control in other situations where the
increment is desired.  This patch adds a failing test to expose the
problem.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13799

Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2019-04-11 04:17:09 +00:00
Garming Sam
6062d7241d ldb: Add ORDERED_INTEGER to the proto-schema handling
Adding ordered integer proto schema handling in kv index cache.  This
allows ordered 64 bit integers to be used in cached fields like
@ATTRIBUTES

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-04-08 02:07:23 +00:00
Aaron Haslett
c9b2a37268 ldb: activating <= and >= indexing for integers
Activating <= and >= mdb indexing in samba for int32 and int64 attributes by:
1. Adding index_format_fn to LDB_SYNTAX_SAMBA_INT32 in ldb_samba
2. Cloning the 64bit LDB_SYNTAX_INTEGER type as LDB_SYNTAX_ORDERED_INTEGER
3. Adding index_format_fn to the new type
4. Modifying LargeInteger use the new type in samba schema
5. Bumping the index version to trigger reindexing

Pair-programmed-with: Garming Sam <garming@catalyst.net.nz>

Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz>
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-04-08 02:07:23 +00:00
Douglas Bagnall
c5f7b07ad2 dsdb/modules: minor comment typos in samba_dsdb
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-04-05 04:41:25 +00:00
Douglas Bagnall
927a5e3c9d dsdb mods/extended_dn_store: used the ldb we already have
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-04-05 04:41:25 +00:00
Douglas Bagnall
c078ea7828 spell "recursive"
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-04-05 04:41:25 +00:00
Michael Hanselmann
29d7c80ee4 oLschema2ldif: Resolve multiple parsing bugs
The "oLschema2ldif" program contained multiple bugs triggered by
malformed inputs:

* Iteration beyond list of recognized dsdb syntax OIDs when value wasn't
  found (bug 9567)
* NULL pointer dereference when input didn't define a name
* Heap buffer overflows for unterminated token values

Tests are added to reproduce all identified bugs.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9567

Signed-off-by: Michael Hanselmann <public@hansmi.ch>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>

Then adapted to use ARRAY_SIZE() consistently as suggested by
metze.

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Apr  3 02:43:07 UTC 2019 on sn-devel-144
2019-04-03 02:43:07 +00:00
Mathieu Parent
4ae2fb2e74 Relax GPGME version check
The current method require at least the same version as during the build. This is not needed.

Used symbols indicate the minimum is 1.2.0

Bug-Debian: http://bugs.debian.org/886333

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13880

Signed-off-by: Mathieu Parent <math.parent@gmail.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2019-04-03 01:40:22 +00:00
Mathieu Parent
720396f0fb Spelling fix s/informations/information/
Signed-off-by: Mathieu Parent <math.parent@gmail.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Martin Schwenke <martin@meltin.net>
2019-04-02 01:12:10 +00:00
Garming Sam
a2b1970a37 acl_read: Fix regression caused by db15fcfa89 for empty lists
The original code never dereferenced attrs and only added "*" if attrs
was NULL (not if attrs[0] was NULL).

This causes significant performance issues with the new paged_results
module introduced for 4.10 as the initial GUID search requests no
attributes. This GUID search turns into a search for "*" and ends up
allocating memory for the entire database.

This never appears to cause changes in the final result set, only
intermediate processing.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13836

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Fri Mar 29 18:37:29 UTC 2019 on sn-devel-144
2019-03-29 18:37:29 +00:00
Aaron Haslett
24efa3ca53 ldb: cmocka test for empty attributes bug
Cmocka test exposing LDB bug where a request with an empty attributes
list returns a response containing all attributes.  The bug is in the
ACL module and will be fixed in the next commit.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13836

Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-03-29 17:29:31 +00:00
Aaron Haslett
7f1b6455fd paged_search: perf testing paged search
Adding medley performance run with paged search module.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13836

Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-03-29 17:29:31 +00:00
Samuel Cabrero
e23425a03c s4:dsdb: Check errno to determine if crypt or crypt_r succeeded
The behavior of these functions upon errors depends on the implementation.
The GNU libc implementation seems to return a null hash, but others like
libxcrypt returns a invalid hash string '*0'.

Signed-off-by: Samuel Cabrero <scabrero@suse.de>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2019-03-22 14:03:19 +00:00
Andrew Bartlett
fdb6305c86 build: Remove bld.gen_python_environments()
This was part of --extra-python support.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2019-03-21 04:06:14 +00:00
Stefan Metzmacher
3e8a435d27 dsdb:repl_meta_data: allow CONTROL_DBCHECK_FIX_LINK_DN_NAME to by pass rename
We need a way to rename an object without updating the replication meta
data.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13816

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-03-14 02:12:19 +00:00
Volker Lendecke
d7de2f7748 lib: Remove "struct sid_parse_ret" again
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-03-12 00:42:19 +00:00
Volker Lendecke
e18610a197 lib: Make sid_parse return the parsed length
Use a temporary struct as a return value to make the compiler catch all
callers. If we just changed bool->ssize_t, this would just generate a
warning. struct sid_parse_ret will go away in the next commit

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-03-12 00:42:19 +00:00
Andrew Bartlett
6f2558cab8 dsdb: Provide better error strings in rootdse GUID attribute handling
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2019-03-07 03:50:20 +00:00
Andrew Bartlett
30f93bc7ac kcc: Give a better error message when samdb_ntds_objectGUID fails
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2019-03-07 03:50:20 +00:00
Andrew Bartlett
0c52a6bee7 dsdb: Unify samdb_{get,set}_ntds_{objectGUID,invocation_id}
The new unified versions have better debugging and ensure
that both functions continue to have the same control flow.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2019-03-07 03:50:20 +00:00
Garming Sam
4a9a77f454 paged_results: Remove C++ commment and unneeded TODO
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Tim Beale <timbeale@catalyst.net.nz>
2019-03-07 02:14:15 +00:00
Douglas Bagnall
c942614eae dsdb pytsts: reduce scale of subtree rename speed test
The speed test, when it was introduced a few patches ago, was
deliberately slow so that we could see how much better the changes
were. It used 500 users, 50 groups, and 27 computers.

Before the changes, it took this long:

rename ou took 64.373s
rename group took 0.160s
rename user took 0.004s
rename computer took 0.123s

After using the sorted links, it took this long:

rename ou took 12.984s
rename group took 0.161s
rename user took 0.004s
rename computer took 0.122s

And with the final patch to stop the linear search early on success:

rename ou took 11.680s
rename group took 0.089s
rename user took 0.004s
rename computer took 0.128s

"rename ou" is the one we were aiming at. Now that we have done that,
we reduce the size of the test so as not to slow down everyone's
autobuilds.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-03-04 21:41:18 +00:00
Douglas Bagnall
e4ac7fb9dc dsdb/linked_attributes: shortcut exit for backlink fix
In most cases there can only be one link for each GUID. If we assume
that is true, we can skip half the search, on average.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-03-04 21:41:18 +00:00
Douglas Bagnall
4f812c1f32 dsdb/linked_attributes: improve formatting in some places
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-03-04 21:41:18 +00:00
Douglas Bagnall
6d01cb5114 dsdb/linked_attributes: initialise more pointers to NULL
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-03-04 21:41:18 +00:00
Douglas Bagnall
8765ed2f1d dsdb linked attributes: fix forward links faster
Rename operations can be very slow in large database with many group
memberships, because the linked attributes need to be found and
rewritten for each moved object and the way we did that was naive.

For a while now Samba has kept forward links in sorted order, so
finding group memberships can be an O(log n) rather than O(n)
operation. This patch makes use of that.

The backlinks are not sorted, nor are forward links in old databases,
so we have to use a linear search in those cases.

There is a little bit of extra work to handle the few kinds of forward
links (e.g. msDS-RevealedUsers) that have DN+Binary values.

Tim and Garming came up with the basic idea and a prototype.

Pair-programmed-with: Tim Beale <timbeale@catalyst.net.nz>
Pair-programmed-with: Garming Sam <garming@catalyst.net.nz>
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-03-04 21:41:18 +00:00
Douglas Bagnall
518320ae33 dsdb: linked_attributes module knows about sorted links
Until now the linked attrbutes module has allocated its private data
on a per transaction basis, but we prefer to check the sorted links
feature less often than that. So the private data struct is given
module life time and a transaction member to carry out the old role.

In coming patches, the sorted links flag will be used.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-03-04 21:41:18 +00:00
Douglas Bagnall
bf50324fef dsdb:replmd: add compatible feature helper function
repl_meta_data.c uses the compatible features attribute of the
"@SAMBA_DSDB" special object to record that linked attributes are
being stored in the database in a sorted order. Soon the
linked_attributes module is going to want to know the same thing, and
in time other modules will want to know about other compatible
features, so we introduce a helper function.

Error checking is slightly improved.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-03-04 21:41:18 +00:00
Douglas Bagnall
7d8cfe02bb dsdb/pytests: sanity checks for links under subtree renames
These tests will ensure that linked attributes continue to be handled
correctly under forthcoming changes. The la_move_ou_tree_big() test
will show that the changes make this much faster, after which it can
perhaps be removed.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-03-04 21:41:18 +00:00
Douglas Bagnall
0673ad09ae replmd/la: disambiguate error messages a bit
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-03-04 21:41:17 +00:00
Douglas Bagnall
1f97322063 dsdb/group_audit: use common get_parsed_dns_trusted()
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-03-04 21:41:17 +00:00
Douglas Bagnall
16f4c694b5 dsdb:util_links: count el->values with unsigned int
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-03-04 21:41:17 +00:00
Douglas Bagnall
edfd33ab3e tests/rodc_rwdc: p.communicate() gives bytes, not str
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-03-04 21:41:17 +00:00
Swen Schillig
2b2ff12e70 source4: Use wrapper for string to integer conversion
In order to detect an value overflow error during
the string to integer conversion with strtoul/strtoull,
the errno variable must be set to zero before the execution and
checked after the conversion is performed. This is achieved by
using the wrapper function strtoul_err and strtoull_err.

Signed-off-by: Swen Schillig <swen@linux.ibm.com>
Reviewed-by: Ralph Böhme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-03-01 00:32:11 +00:00
Andreas Schneider
5854fcdbe9 s4:dsdb: Remove unused header file
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2019-02-27 07:59:27 +00:00
Andreas Schneider
5890eb7792 s4:dsdb: Only use the required md4 and md5 header files
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2019-02-27 07:59:27 +00:00
Andreas Schneider
195322b83e s4:dsdb: Only use the required md4 header file
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2019-02-27 07:59:27 +00:00
Volker Lendecke
54d2e88fc7 dsdb: Align integer types
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-02-27 01:35:19 +01:00
Volker Lendecke
071af60d74 audit_log: Use dom_sid_str_buf
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-02-27 01:35:19 +01:00
Noel Power
5f9a5ef262 s4/param: Fix provision_get_schema leaking python object
provision_get_schema returns a ldb_context object which is stored
in a python object. As a result the parent python object is never
decrefed and probably not released ever.

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-02-21 04:09:19 +01:00
Gary Lockyer
ea2de21dd8 s4 dsdb util: samdb_client_site_name clean up
* Initialise pointers to NULL
* replace talloc_free with TALLOC_FREE
* add goto exit to ensure memory deallocated correctly

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Thu Feb 14 06:53:14 CET 2019 on sn-devel-144
2019-02-14 06:53:14 +01:00
Gary Lockyer
f0e96d21b5 s4 dsdb util: remove samdb_search_count
All the uses have been replaced with calls to dsdb_domain_count, so it
is no longer needed.

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-02-14 05:03:24 +01:00
Gary Lockyer
2546f26091 s4 dsdb util: samdb_client_site_name use dsdb_domain_count
Replace the call to samdb_search_count with dsdb_domain_count. As this
is the only remaining caller of samdb_search_count, replacing it will
allow the removal of samdb_search_count.

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-02-14 05:03:24 +01:00
Gary Lockyer
12fcab1181 s4 dsdb util: add dsdb_domain_count
This counts the number of objects that are in the domain,
provided a domain SID was supplied (otherwise it just
counts all the objects).

This routine avoids allocating memory for the full
result set by using a callback.

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-02-14 05:03:23 +01:00
Douglas Bagnall
cb502997b3 replmd: move a if (ret) closer to ret source
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-02-13 04:15:14 +01:00
Douglas Bagnall
c874b62556 dsdb: check NULL guid strings in la_fix_links
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-02-13 04:15:14 +01:00
Douglas Bagnall
a086a6457b dsdb: linked attrs: check a talloc_new()
Also we can defer it past a thing that doesn't need or check for it.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-02-13 04:15:14 +01:00
Douglas Bagnall
5b0a9818ff dsdb: make get_parsed_dns_trusted() a common helper function
We are already using it in two places, and are about to add a third.

The version in repl_meta_data.c did more work in the case that the
parsed_dns can't really be trusted to conform to the expected format;
this is now a wrapper called get_parsed_dns_trusted_fallback().

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-02-13 04:15:14 +01:00
Stefan Metzmacher
09c4e78fef dsdb/tests/vlv: use only one toplevel dn that is correctly cleaned up
Before "OU=vlvtestou2,%s" % (self.base_dn) was left behind after the
test.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-02-11 11:41:21 +01:00
Stefan Metzmacher
9f6ade21f5 s4:dsdb:util: export SAMBA_CPS_{ACCOUNT,USER_PRINCIPAL,FULL}_NAME for check password script
This allows the check password script to reject the username and other
things.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-02-11 07:43:32 +01:00
Stefan Metzmacher
65e52c24bc s4:dsdb:util: make use of samba_runcmd_export_stdin()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2019-02-07 22:47:22 +01:00
Noel Power
61670169d5 Clean up reference used with PyDict_Setxxx
PyDictSetxxx methods don't steal reference so if the items added
to the dictionary were created just for the purpose of inserting
into the dict then we need to decref them.

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>

Autobuild-User(master): Noel Power <npower@samba.org>
Autobuild-Date(master): Thu Feb  7 17:17:46 CET 2019 on sn-devel-144
2019-02-07 17:17:46 +01:00
Noel Power
53d973f59c Cleanup references to module objects returned from PyImport_ImportModule
Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2019-02-07 13:44:30 +01:00
David Disseldorp via samba-technical
bdb90ec974 build: replace SAMBA3_ADD_OPTION with samba_add_onoff_option
The former is just an alias for the latter. samba_add_onoff_option()
better describes what the function actually does, so use that and
remove the alias.

Signed-off-by: David Disseldorp <ddiss@samba.org>
Reviewed-by: Noel Power <npower@samba.org>
2019-02-01 16:08:25 +01:00
Garming Sam
f00362fb3d cracknames: Change search filter to use the smaller index
In large domains with many users, '(objectClass=User)' may as well not
be specified because it's iterating over the entire database.

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-02-01 03:36:17 +01:00
Andreas Schneider
4d1ae1904d s4:samdb: Use C99 initializer for last element of ldb_map_objectclass
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2019-01-28 10:29:24 +01:00
Andreas Schneider
8e1f9675c9 s4:dsdb: Use C99 initializer in util
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2019-01-28 10:29:24 +01:00
Gary Lockyer
60aa7b3634 group_audit: error handling in group change
Generate an appropriate log message in the event of an error
log_group_membership_changes.  As the changes have not been applied to
the database, there is no easy way to determine the intended changes.
This information is available in the "dsdbChange" audit messages, to
avoid replicating this logic for what should be a very rare occurrence
we simply log it as a "Failure"

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Sat Jan 19 22:32:05 CET 2019 on sn-devel-144
2019-01-19 22:32:05 +01:00
Gary Lockyer
942567afda group_audit: Tests for error handling in group change
Add tests to exercise the error handling in
log_group_membership_changes.

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-01-19 19:21:20 +01:00
Douglas Bagnall
f4b3229f5b s4/py_dsdb: catch/handle alloc failures in py_dsdb_normalise_attributes()
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Noel Power <noel.power@suse.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-01-19 19:21:20 +01:00
Andreas Schneider
c195134e35 s4:dsdb: Fix size type for num_of_attrs in acl_read
This fixes a compile error on sn-devel184.

Signed-off-by: Andreas Schneider <asn@samba.org>
2019-01-19 12:24:18 +01:00
Andreas Schneider
9ac30e77f3 s4:dsdb: Fix size types in audit_log
audit_log.c:878:7: error: assuming signed overflow does not occur when
simplifying conditional to constant [-Werror=strict-overflow]

Signed-off-by: Andreas Schneider <asn@samba.org>
2019-01-19 12:24:18 +01:00
Volker Lendecke
ff2dbe24b8 dns_update: samba_dnsupdate's exit code is not an errno
This avoids confusing messages, samba_dnsupdate returns the number of
failed updates

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-15 07:53:21 +01:00
Swen Schillig
e29cb5095b Fix typos and ban the rams from samba
Signed-off-by: Swen Schillig <swen@linux.ibm.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Volker Lendecke <Volker.Lendecke@SerNet.DE>
2019-01-10 02:41:29 +01:00
Volker Lendecke
78214d3ccb dsdb: Print strerror in addition to errno
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-10 02:41:29 +01:00
Volker Lendecke
0d208f42cc pydsdb: Use dom_sid_str_buf
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-08 03:40:27 +01:00
Andrew Bartlett
42dde0bdd3 group_audit: Ensure we still log membership changes (with an error) where status != LDB_SUCCESS
This restores the previous behaviour.  It causes (only) the event ID
to be omitted if status != LDB_SUCCESS or there was a problem getting
the group type.

Errors at this stage are exceedingly rare, because the values have
already been checked by the repl_meta_data module, but this is
cosistent with the rest of the module again.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Sat Dec 22 01:58:48 CET 2018 on sn-devel-144
2018-12-22 01:58:48 +01:00
Gary Lockyer
87a8325a0d s4 group_audit: Add Windows Event Id's to Group membership changes
Generate a GroupChange event when a user is created with a PrimaryGroup
membership.  Log the windows event id in the JSON GroupChange message.

Event Id's supported are:
	4728	A member was added to a security enabled global group
	4729	A member was removed from a security enabled global
		group
	4732	A member was added to a security enabled local group
	4733	A member was removed from a security enabled local group
	4746	A member was added to a security disabled local group
	4747	A member was removed from a security disabled local group
	4751	A member was added to a security disabled global group
	4752	A member was removed from a security disabled global
		group
	4756	A member was added to a security enabled universal
		group
	4757	A member was removed from a security enabled universal
		group
	4761	A member was added to a security disabled universal
		group
	4762	A member was removed from a security disabled universal
		group

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-12-21 22:16:09 +01:00
Aaron Haslett
22f1c4005c paged results: testing suite for new paged results module
Testing the new GUID list based paged results module

Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Gary Lockyer <gary@samba.org>
Autobuild-Date(master): Fri Dec 21 11:10:30 CET 2018 on sn-devel-144
2018-12-21 11:10:30 +01:00
Aaron Haslett
975807001e paged results: new paged results module using GUID list
Replacing paged results module to use GUID list instead of storing
result list in memory, in order to improve memory performance.

Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-12-21 07:21:19 +01:00
Aaron Haslett
96c03c7532 vlv: tests for delete, add, and modify cases
More vlv testing for cases involving modifying, deleting, and adding records
while observing the effect on already initialised views.

Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-12-21 07:21:19 +01:00
Andrew Bartlett
1cff50febe dsdb: sort DSDB_EXTENDED defines by OID
This helps avoid duplicate values and clearly indicates what value to select next.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Mon Dec 17 04:30:39 CET 2018 on sn-devel-144
2018-12-17 04:30:39 +01:00
Aaron Haslett
1fd4cdfafa drepl: schema repl race condition fix
Adds final schema consistency check before committing changes.
Aborts if corruption found.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12889
Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-12-17 01:24:15 +01:00
Andrew Bartlett
ce33dd1196 dsdb: Remove readOnlySchema concept from Samba
This is a hold-over from the LDAP backend project, which has not yet been revived.

There will be bigger issues than what to do if the schema changes if this ever comes back
and our schema code is way to complex at the moment.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2018-12-17 01:24:14 +01:00
Gary Lockyer
e97acc714d dsdb audit_log: Add windows event codes to password changes
Add a new "eventId" element to the PasswordChange JSON log messages.
This contains a Windows Event Code Id either:
	4723	Password changed
	4724	Password reset

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-12-14 18:57:52 +01:00
Joe Guo
8e3c194453 PY3: change shebang to python3 in source4/dsdb dir
Signed-off-by: Joe Guo <joeg@catalyst.net.nz>
Reviewed-by: Noel Power <npower@samba.org>
2018-12-14 14:40:20 +01:00
Andrew Bartlett
edab1318f9 audit_logging: Remove debug log header and JSON Authentication: prefix
Feedback from real-world users is that they really want raw JSON
strings in the log.

We can not easily remove the leading "  " but the other strings above
and before the JSON are really annoying to strip back off

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13714

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2018-12-14 10:27:18 +01:00
Noel Power
2b3c9b8e6a s4/dsdb/tests/python: Restore embed NULL tests for Python3
commit: 34ca15fb04 changed the
test so embedded NULLs were avoided when python3 was used.
This was due to the fact the string comparison function
'locale.strcoll' cannot handle embedded NULLs. This commit

a) Restores the test data using embedded NULLs which was
   not used depending on the python runtime version
b) Removes the problematic calculation of expected sorting order
   and instead uses sort order data stored in files.

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-12-14 00:51:32 +01:00
Noel Power
d20f06986e selftest: Convert samba4.ldap.sort.python to planoldpythontest
Currently the test only runs fully under python2. As an interim
measure while we figure out how to get this to work property under
python3 I have converted the test to planoldpythontest so it also
can run under python2

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-12-14 00:51:32 +01:00
Noel Power
34ca15fb04 s4/dsdb/tests/python: PY3 allow test samba4.ldap.sort pass
Adjust test data to remove use of embedded NULLs.

We are getting the following exception when running the test
under python3

Exception: Exception: Traceback (most recent call last):
  File "source4/dsdb/tests/python/sort.py", line 181, in setUp
    key=cmp_to_key_fn(locale.strcoll))
ValueError: embedded null character

Looking at the source code for locale.strcoll the lhs & rhs
params are processed using 'PyUnicode_AsWideCharString(s, NULL)'

Documentation for PyUnicode_AsWideCharString states:

"Convert the Unicode object to a wide character string.
 The output string always ends with a null character. If size is
 not NULL, write the number of wide characters (excluding the
 trailing null termination character) into *size. Note that the
 resulting wchar_t string might contain null characters, which
 would cause the string to be truncated when used with most C
 functions. If size is NULL and the wchar_t* string contains null
 characters a ValueError is raised."

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-12-10 10:38:24 +01:00
Noel Power
c319684d51 s4/dsdb/tests/python: partial PY3 port for samba4.ldap.sort
Test still fails after applying the following fixes

a) only decode byte or (py2) str objects
b) fix sorted function no longer use cmp func, use compat
   cmp_to_key_fn instead
c) convert ldb.bytes returned from ldb search results
d) convert sort_functions.keys() to list so array slicing works

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-12-10 10:38:24 +01:00
Noel Power
f8c05eb75a s4/dsdb/tests/python: PY3 port samba4.deletetest
Fix misc ldb.bytes needing to be stringified for tests to succeeed

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-12-10 10:38:23 +01:00
Noel Power
e8413056d3 s4/dsdb/tests/python: PY3 Port samba4.ldap.password_lockout
use Exception.args member as exception is no longer supports
indexing.

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-12-10 10:38:23 +01:00
Noel Power
2b09cfe083 s4/dsdb/tests/python: PY3 port for samba4.ldap.rodc_rwdc.python
* Make sure samba-tool is called with correct PYTHON version
* Convert ldb.bytes results to string for comparison with expected
  results

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-12-10 10:38:23 +01:00
Noel Power
cc8a4eeb53 s4/dsdb/tests/python: PY3 port for samba4.ldap.linked_attributes
Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-12-10 10:38:23 +01:00
Noel Power
c83e1a6aea s4/dsdb/tests: PY3 port samba4.ldap.vlv
Misc changes mostly around use of ldb.bytes, bytes and string to get
the test to work. Additionally results of a range cannot be combined
with a list using the '+' operator (need to enclose the range with
list).

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-12-10 10:38:23 +01:00
Noel Power
74aabacc34 s4/dsdb/tests/python: PY3 port samba4.ldap.sites
Fix comparison of ldb.bytes with string
Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-12-10 10:38:23 +01:00
Noel Power
397ab3afbd s4/dsdb/tests: PY3 fix failing samba4.ldap.notification
Convert ldb.bytes object to string for further processing

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-12-10 10:38:23 +01:00
Noel Power
60a9998ea3 s4/dsdb/tests: PY3 port samba4.user_account_control test
Fix dict_items are not combinable with '+' operator error, need
to convert to list first.

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-12-10 10:38:23 +01:00
Noel Power
32c8c820a2 s4/dsdb/tests/python: PY3 port samba4.tokengroups.krb5
gensec.Security.update takes bytes as param not string with py3

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-12-10 10:38:23 +01:00
Noel Power
4186335cd8 s4/dsdb/tests: Port PY3 ldap tests
Fix various assertTrue/assertEquals so ldb.bytes (PY3)
comparaisons work both in PY3 & PY2

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-12-10 10:38:23 +01:00
Noel Power
55a3817166 s4/dsdb/tests: PY3 port samba4.ldap.passwordsettings test
* Fix various assertEquals comparing ldb.bytes with string
  when running with PY3
* Fix a couple of tuple assignments to exception (not supported
  in PY3)

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-12-10 10:38:21 +01:00
Noel Power
ac7baa6e92 s4/dsdb/tests/python: PY3 port samba4.sam.python test
Misc changes to ensure samba4.sam.python test will run under
python2/python3

* various objectSID values when formatted need to be treated
as strings for tests.

* DOMAIN_RID_USERS, DOMAIN_RID_DOMAIN_MEMBERS, DOMAIN_RID_DCS,
  DOMAIN_RID_READONLY_DCS are all integers (but attibutes are
  ldb.bytes in PY3, need to adust various assertEquals.
* Make sure password is encoded correctly

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-12-10 10:38:21 +01:00
Noel Power
0d73a2b0a2 PY3: net.change_password & net.set_password take string not bytes
Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-12-10 10:38:21 +01:00
Olly Betts
28aeb86a9f Fix spelling mistakes
Signed-off-by: Olly Betts <olly@survex.com>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-11-30 03:35:13 +01:00
Volker Lendecke
a167014554 krb5_wrap: Add a talloc_ctx to smb_krb5_principal_get_realm()
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2018-11-28 17:44:15 +01:00
Tim Beale
fde9f7c81b CVE-2018-16857 dsdb/util: Add better default lockOutObservationWindow
Clearly the lockOutObservationWindow value is important, and using a
default value of zero doesn't work very well.

This patch adds a better default value (the domain default setting of 30
minutes).

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13683

Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(master): Wed Nov 28 11:31:14 CET 2018 on sn-devel-144
2018-11-28 11:31:14 +01:00
Tim Beale
13014aea13 CVE-2018-16857 dsdb/util: Fix lockOutObservationWindow for PSOs
Fix a remaining place where we were trying to read the
msDS-LockoutObservationWindow as an int instead of an int64.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13683

Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-11-28 08:22:25 +01:00
Tim Beale
c7b937c5aa CVE-2018-16857 dsdb/util: Correctly treat lockOutObservationWindow as 64-bit int
Commit 442a38c918 refactored some code into a new
get_lockout_observation_window() function. However, in moving the code,
an ldb_msg_find_attr_as_int64() inadvertently got converted to a
ldb_msg_find_attr_as_int().

ldb_msg_find_attr_as_int() will only work for values up to -2147483648
(about 3.5 minutes in MS timestamp form). Unfortunately, the automated
tests used a low enough timeout that they still worked, however,
password lockout would not work with the Samba default settings.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13683

Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-11-28 08:22:25 +01:00