1
0
mirror of https://github.com/samba-team/samba.git synced 2025-01-25 06:04:04 +03:00

107130 Commits

Author SHA1 Message Date
Ralph Boehme
a529401dfd CVE-2018-1057: s4:dsdb/acl: only call dsdb_acl_debug() if we checked the acl in acl_check_password_rights()
Bug: https://bugzilla.samba.org/show_bug.cgi?id=13272

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2018-03-12 10:05:43 +01:00
Ralph Boehme
09eed842f7 CVE-2018-1057: s4:dsdb/password_hash: add a helper variable for passwordAttr->num_values
Bug: https://bugzilla.samba.org/show_bug.cgi?id=13272

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2018-03-12 10:05:43 +01:00
Ralph Boehme
116c4e3160 CVE-2018-1057: s4:dsdb/password_hash: add a helper variable for LDB_FLAG_MOD_TYPE
Bug: https://bugzilla.samba.org/show_bug.cgi?id=13272

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2018-03-12 10:05:43 +01:00
Ralph Boehme
429a17f9b0 CVE-2018-1057: s4:dsdb/tests: add a test for password change with empty delete
Note that the request using the clearTextPassword attribute for the
password change is already correctly rejected by the server.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=13272

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2018-03-12 10:05:43 +01:00
Jeremy Allison
189d12940c CVE-2018-1050: s3: RPC: spoolss server. Protect against null pointer derefs.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11343

Signed-off-by: Jeremy Allison <jra@samba.org>
2018-03-12 10:05:38 +01:00
Karolin Seeger
24df683b46 VERSION: Bump version up to 4.6.14...
and re-enable GIT_SNAPSHOT.

Signed-off-by: Karolin Seeger <kseeger@samba.org>
(cherry picked from commit 2ed874196b73fce0e2376f0a4237f9986413e95f)
2018-03-12 10:03:36 +01:00
Andreas Schneider
ae55cfefd7 s3:smbd: Do not crash if we fail to init the session table
This should the following segfault with SMB1:

  #6  sig_fault (sig=<optimized out>) at ../lib/util/fault.c:94
  #7  <signal handler called>
  #8  smbXsrv_session_create (conn=conn@entry=0x5654d3512af0, now=now@entry=131594481900356690, _session=_session@entry=0x7ffc93a778e8)
      at ../source3/smbd/smbXsrv_session.c:1212
  #9  0x00007f7618aa21ef in reply_sesssetup_and_X (req=req@entry=0x5654d35174b0) at ../source3/smbd/sesssetup.c:961
  #10 0x00007f7618ae17b0 in switch_message (type=<optimized out>, req=req@entry=0x5654d35174b0) at ../source3/smbd/process.c:1726
  #11 0x00007f7618ae3550 in construct_reply (deferred_pcd=0x0, encrypted=false, seqnum=0, unread_bytes=0, size=140, inbuf=0x0, xconn=0x5654d35146d0)
      at ../source3/smbd/process.c:1762
  #12 process_smb (xconn=xconn@entry=0x5654d3512af0, inbuf=<optimized out>, nread=140, unread_bytes=0, seqnum=0, encrypted=<optimized out>,
      deferred_pcd=deferred_pcd@entry=0x0) at ../source3/smbd/process.c:2008
  #13 0x00007f7618ae4c41 in smbd_server_connection_read_handler (xconn=0x5654d3512af0, fd=40) at ../source3/smbd/process.c:2608
  #14 0x00007f761587eedb in epoll_event_loop_once () from /lib64/libtevent.so.0

Inspection the core shows that:
  conn->client-session_table is NULL
  conn->protocol is PROTOCOL_NONE

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13315

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit a89a7146563f2d9eb8bc02f1c090158ee499c878)

Autobuild-User(v4-6-test): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(v4-6-test): Fri Mar  9 01:47:40 CET 2018 on sn-devel-144
2018-03-09 01:47:40 +01:00
Dan Robertson
8fe0589cb1 libsmb: Use smb2 tcon if conn_protocol >= SMB2_02
When the connection protocol is SMB2 the tid from the smb1 member is
used instead of smb2 in cli_state_set_tid which often results in a null
deref.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13310

Signed-off-by: Dan Robertson <drobertson@tripwire.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit b67ffaf518c971817b167b41bf6226cddfdcfd2f)
2018-03-08 21:55:23 +01:00
Volker Lendecke
3dadbb3556 torture: Add test for channel sequence number handling
We run into an assert when the csn wraps

Bug: https://bugzilla.samba.org/show_bug.cgi?id=13215

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Sun Jan 14 14:47:15 CET 2018 on sn-devel-144

(cherry picked from commit 0abe16a5343de9a69bb5cccbad9809b28b642f45)
2018-03-08 21:55:23 +01:00
Volker Lendecke
597aba166c smbXcli: Add "force_channel_sequence"
This enables use of the channel sequence number even for
non-multi-channel servers. This makes our client invalid, but we need to
protect against broken clients with tests.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=13215

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit cd288a08500b1cc38ef26e5cb8ef754b4da658b6)
2018-03-08 21:55:23 +01:00
Volker Lendecke
082c08efb4 smbd: Fix channel sequence number checks for long-running requests
When the client's supplied csn overflows and hits a pending, long-running
request's csn, we panic. Fix this by counting the overflows in
smbXsrv_open_global0->channel_generation

Bug: https://bugzilla.samba.org/show_bug.cgi?id=13215

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Volker Lendecke <vl@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit 0b57434151a8334a6e9b9b7542824ce4915421a2)
2018-03-08 21:55:23 +01:00
Volker Lendecke
c3bce29f1e smbd: Remove a "!" from an if-condition for easier readability
Bug: https://bugzilla.samba.org/show_bug.cgi?id=13215

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit 03f65a7cdc91091a171269cfebc9916f2f678388)
2018-03-08 21:55:23 +01:00
Volker Lendecke
65992c6b4a torture4: Fix typos
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit 71cee27962cba53da3249bd3f5ece32a1d10071d)
2018-03-08 21:55:23 +01:00
Volker Lendecke
dc5dbc6acd smbd: Fix a typo
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit e8636e7ab75f89e89ef054b5d4aa6c07fddcbe2a)
2018-03-08 21:55:23 +01:00
Stefan Metzmacher
b7267199dd s3:smb2_server: allow logoff, close, unlock, cancel and echo on expired sessions
Windows client at least doesn't have code to replay
a SMB2 Close after getting NETWORK_SESSION_EXPIRED,
which locks out a the client and generates an endless
loop around NT_STATUS_SHARING_VIOLATION.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13197

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2018-03-08 21:55:23 +01:00
Stefan Metzmacher
7118165d63 s3:smbd: return the correct error for cancelled SMB2 notifies on expired sessions
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13197

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2018-03-08 21:55:22 +01:00
Stefan Metzmacher
f0e7a7c96b s4:torture: add smb2.session.expire2 test
This demonstrates the interaction of NT_STATUS_NETWORK_SESSION_EXPIRED
and various SMB2 opcodes.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13197

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2018-03-08 21:55:22 +01:00
Karolin Seeger
d0c6802bd6 Revert "HEIMDAL:kdc: fix memory leak when decryption AuthorizationData"
This reverts commit 678a7a32473b1f64421cd905b7d535878eb11cab.

Autobuild-User(v4-6-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-6-test): Wed Feb 21 15:14:49 CET 2018 on sn-devel-144
2018-02-21 15:14:49 +01:00
Karolin Seeger
c190c37540 Revert "HEIMDAL:kdc: decrypt b->enc_authorization_data in tgs_build_reply()"
This reverts commit e8988e614aaf269b24b072e483047bdcd80fef33.
2018-02-21 11:23:24 +01:00
Karolin Seeger
e1a5f808c5 Revert "HEIMDAL:kdc: if we don't have an authenticator subkey for S4U2Proxy we need to use the additional tickets key"
This reverts commit ec57c13dc378d15dad98efd59e86bcc2775c5b0a.
2018-02-21 11:23:24 +01:00
Karolin Seeger
542382aa2f Revert "s4:kdc: fix the principal names in samba_kdc_update_delegation_info_blob"
This reverts commit 2557d5c6235f7d24866163124fc254cfe81d3871.
2018-02-21 11:23:24 +01:00
Karolin Seeger
fb65808bb2 Revert "HEIMDAL:kdc: let _kdc_encode_reply() use the encryption type based on the server key"
This reverts commit 03484706e4ff546fc7fe41124d896e9f7840fe80.
2018-02-21 11:23:24 +01:00
Karolin Seeger
4afb9bddeb Revert "HEIMDAL:hdb: export a hdb_enctype_supported() helper function"
This reverts commit 18d7cf191718b3a30165a43271e503cc07ca5b50.
2018-02-21 11:23:24 +01:00
Karolin Seeger
cb60d1c217 Revert "s4:kdc: use the strongest possible tgs session key"
This reverts commit 9fdf175905efde803941a5876ce7e060013fc9a0.
2018-02-21 11:23:24 +01:00
Karolin Seeger
0cd6906175 Revert "TODO s4:kdc: msDS-SupportedEncryptionTypes only on computers"
This reverts commit fe146338f304a52f861777ada5774887fe0776e3.
2018-02-21 11:23:23 +01:00
Karolin Seeger
89f27fab18 Revert "TODO s4:kdc: indicate support for new encryption types by adding empty keys"
This reverts commit bf07697273017014516010475f79be3e59a2ce07.
2018-02-21 11:23:23 +01:00
Karolin Seeger
3a54a04973 Revert "HEIMDAL:kdc: use the correct authtime from addtitional ticket for S4U2Proxy tickets"
This reverts commit 9ecdf21e174ba7525b77035664428fbdcbf53690.
2018-02-21 11:23:23 +01:00
Volker Lendecke
56a40ab005 samba: Only use async signal-safe functions in signal handler
Otherwise shutdown can hang

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13240

Signed-off-by: Björn Baumbach <bb@sernet.de>
(similar to commit 361ea743576cf125d7957a97ed78a0446dab1a19)

Autobuild-User(v4-6-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-6-test): Tue Feb 20 17:03:44 CET 2018 on sn-devel-144
2018-02-20 17:03:44 +01:00
Garming Sam
670af37291 subnet: Avoid a segfault when renaming subnet objects
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13031

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-02-20 12:52:17 +01:00
Stefan Metzmacher
f2e21e6926 HEIMDAL:kdc: use the correct authtime from addtitional ticket for S4U2Proxy tickets
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13137

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2018-02-20 12:52:17 +01:00
Stefan Metzmacher
ffda28e9b1 TODO s4:kdc: indicate support for new encryption types by adding empty keys
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13135
2018-02-20 12:52:17 +01:00
Stefan Metzmacher
075f061ca3 TODO s4:kdc: msDS-SupportedEncryptionTypes only on computers
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13135
2018-02-20 12:52:17 +01:00
Stefan Metzmacher
7d0559e0eb s4:kdc: use the strongest possible tgs session key
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13135

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2018-02-20 12:52:17 +01:00
Stefan Metzmacher
2a7392d3b2 HEIMDAL:hdb: export a hdb_enctype_supported() helper function
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13135

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2018-02-20 12:52:17 +01:00
Stefan Metzmacher
8ac00b066c HEIMDAL:kdc: let _kdc_encode_reply() use the encryption type based on the server key
Currently the value is the same anyway as the session key is always of the
same type as server key up to now, but that will change shortly.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13135

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2018-02-20 12:52:17 +01:00
Stefan Metzmacher
9f3571aa20 s4:kdc: fix the principal names in samba_kdc_update_delegation_info_blob
We need the target service without realm, but the proxy services with realm.

I have a domain with an w2008r2 server and a samba and now both generate
the same S4U_DELEGATION_INFO.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13133

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2018-02-20 12:52:17 +01:00
Stefan Metzmacher
312bf1c331 HEIMDAL:kdc: if we don't have an authenticator subkey for S4U2Proxy we need to use the additional tickets key
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13131

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2018-02-20 12:52:17 +01:00
Stefan Metzmacher
3dd52dd0df HEIMDAL:kdc: decrypt b->enc_authorization_data in tgs_build_reply()
We do this after checking for constraint delegation (S4U2Proxy).

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13131

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2018-02-20 12:52:17 +01:00
Stefan Metzmacher
9ec1a523d2 HEIMDAL:kdc: fix memory leak when decryption AuthorizationData
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13131

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2018-02-20 12:52:17 +01:00
Karolin Seeger
fd09a022d0 VERSION: Disable GIT_SNAPSHOT for the 4.6.13 release.
Signed-off-by: Karolin Seeger <kseeger@samba.org>
samba-4.6.13
2018-02-14 10:39:29 +01:00
Karolin Seeger
2ed874196b VERSION: Bump version up to 4.6.14...
and re-enable GIT_SNAPSHOT.

Signed-off-by: Karolin Seeger <kseeger@samba.org>
2018-02-14 10:39:29 +01:00
Karolin Seeger
38e71baaba WHATSNEW: Add release notes for Samba 4.6.13.
Signed-off-by: Karolin Seeger <kseeger@samba.org>
2018-02-14 10:39:29 +01:00
David Disseldorp
666c6802cb build: fix ceph_statx check when configured with libcephfs_dir
When configured with a custom libcephfs_dir, the ceph_statx check fails
to link. This is due to the location of the ceph-common dependency,
which is installed under a ceph subdirectory.

ceph/build > make DESTDIR=./inst install
...
ceph/build > find inst/|grep -e /libcephfs -e /libceph-common
inst/usr/local/lib64/ceph/libceph-common.so.0
inst/usr/local/lib64/ceph/libceph-common.so
inst/usr/local/lib64/libcephfs.so.2.0.0
inst/usr/local/lib64/libcephfs.so.2
inst/usr/local/lib64/libcephfs.so
inst/usr/local/include/cephfs/libcephfs.h

Bug: https://bugzilla.samba.org/show_bug.cgi?id=13250

Signed-off-by: David Disseldorp <ddiss@suse.de>
Reviewed-by: Jeff Layton <jlayton@samba.org>

(cherry picked from commit ff7df3d3f5259362a6bb6780d6b532e57e89681d)

Autobuild-User(v4-6-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-6-test): Tue Feb 13 13:36:13 CET 2018 on sn-devel-144
2018-02-13 13:36:13 +01:00
Ralph Boehme
301555830d vfs_fruit: set delete-on-close for empty finderinfo
We previously removed the stream from the underlying filesystem stream
backing store when the client zeroes out FinderInfo in the AFP_AfpInfo
stream, but this causes certain operations to fail (eg stat) when trying
to access the stream over any file-handle open on that stream.

So instead of deleting, set delete-on-close on the stream. The previous
commit already implemented not to list list streams with delete-on-close
set which is necessary to implemenent correct macOS semantics for this
particular stream.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=13181

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Tue Jan  9 17:09:12 CET 2018 on sn-devel-144

(backported from commit e61e9e98e9ff461055daae2fe78f0202f7ed8663)

Autobuild-User(v4-6-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-6-test): Thu Jan 25 19:25:24 CET 2018 on sn-devel-144
2018-01-25 19:25:24 +01:00
Ralph Boehme
9e47e9e28c vfs_fruit: filter out AFP_AfpInfo streams with pending delete-on-close
This is in preperation of fixing the implementation of removing the
AFP_AfpInfo stream by zeroing the FinderInfo out.

We currently remove the stream blob from the underyling filesystem
backing store, but that results in certain operations to fail on any
still open file-handle.

The fix comes in the next commit which will convert to backing store
delete operation to a set delete-on-close on the stream.

This commit adds filtering on streams that have the delete-on-close
set. It is only needed for the fruit:metadata=stream case, as with
fruit:metadata=netatalk the filtering is already done in
fruit_streaminfo_meta_netatalk().

Bug: https://bugzilla.samba.org/show_bug.cgi?id=13181

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 70d8f7c5d25f35b58620c2db8f57c7c0758267b3)
2018-01-25 15:06:21 +01:00
Ralph Boehme
c1e0396bcb vfs_fruit: factor out delete_invalid_meta_stream() from fruit_streaminfo_meta_stream()
No change in behaviour, just some refactoring before adding more code to
fruit_streaminfo_meta_stream() in the next commit.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=13181

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(backported from commit c41e1ea9247611473d30184efd953c61955ead15)
2018-01-25 15:06:21 +01:00
Ralph Boehme
d95b278b00 s4/torture/fruit: enhance zero AFP_AfpInfo stream test
This test more operations in the zeroed out FinderInfo test, ensuring
after zeroing out FinderInfo, operations on the filehandle still work
and that enumerating streams doesn't return the stream anymore.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=13181

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(backported from commit df31e94eb6241f5e5594f6fd0ec1ad7896e02e27)
2018-01-25 15:06:21 +01:00
Ralph Boehme
26da45be00 s4/torture/fruit: ensure AFP_AfpInfo blobs are 0-initialized
Bug: https://bugzilla.samba.org/show_bug.cgi?id=13181

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit a22833c2971dc7234b32741305f40ed62e232e0b)
2018-01-25 15:06:21 +01:00
David Disseldorp
21d0446c48 vfs_default: use VFS statvfs macro in fs_capabilities
Currently the vfs_default fs_capabilities handler calls statvfs
directly, rather than calling the vfs macro. This behaviour may cause
issues for VFS modules that delegate fs_capabilities handling to
vfs_default but offer their own statvfs hook.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=13208

Signed-off-by: David Disseldorp <ddiss@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 4b25c9f4a4d336a16894452862ea059701b025de)

Autobuild-User(v4-6-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-6-test): Mon Jan 22 13:14:03 CET 2018 on sn-devel-144
2018-01-22 13:14:03 +01:00
David Disseldorp
a6b780c52b vfs_ceph: add fs_capabilities hook to avoid local statvfs
Adding the fs_capabilities() hook to the CephFS VFS module avoids
fallback to the vfs_default code-path, which calls statvfs() against the
share path on the *local* filesystem.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=13208

Signed-off-by: David Disseldorp <ddiss@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 2724e0cac29cd1632ea28075a740fcc888affb36)
2018-01-22 08:50:09 +01:00