1
0
mirror of https://github.com/samba-team/samba.git synced 2025-03-11 16:58:40 +03:00

101645 Commits

Author SHA1 Message Date
Stefan Metzmacher
8e5a63969a CVE-2016-0771: librpc: add ndr_dnsp_string_list_copy() helper function
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11128
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11686

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-03-08 11:55:21 +01:00
Stefan Metzmacher
c5045515bc CVE-2016-0771: librpc: add RPC_NDR_DNSSERVER to dcerpc-samba library
RPC_NDR_DNSSERVER is the client interface NDR_DNSP contains just
marshalling helpers.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11128
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11686

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-03-08 11:55:21 +01:00
Stefan Metzmacher
71c64e75e5 CVE-2016-0771: s4:librpc: python_dns and python_dcerpc_dnsp doesn't require client bindings
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11686
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11128

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-03-08 11:55:21 +01:00
Jeremy Allison
1c7096a9f2 CVE-2015-7560: s3: torture3: Add new POSIX-SYMLINK-EA test.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11648

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2016-03-08 11:55:17 +01:00
Jeremy Allison
ee4d4358a2 CVE-2015-7560: s3: torture3: Add new POSIX-SYMLINK-ACL test.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11648

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2016-03-08 11:55:17 +01:00
Jeremy Allison
b13711e386 CVE-2015-7560: s3: libsmb: Add SMB1-only POSIX cli_posix_setacl() functions. Needed for tests.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11648

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2016-03-08 11:55:17 +01:00
Jeremy Allison
3d09f82f7b CVE-2015-7560: s3: libsmb: Rename cli_posix_getfaclXX() functions to cli_posix_getacl() as they operate on pathnames.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11648

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2016-03-08 11:55:16 +01:00
Jeremy Allison
863c44a9dd CVE-2015-7560: s3: smbd: Refuse to set EA's on a symlink.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11648

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2016-03-08 11:55:16 +01:00
Jeremy Allison
f803247dbe CVE-2015-7560: s3: smbd: Silently return no EA's available on a symlink.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11648

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2016-03-08 11:55:16 +01:00
Jeremy Allison
c1fe124813 CVE-2015-7560: s3: smbd: Set return values early, allows removal of code duplication.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11648

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2016-03-08 11:55:16 +01:00
Jeremy Allison
3f59769ffe CVE-2015-7560: s3: smbd: Refuse to get a POSIX ACL on a symlink.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11648

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2016-03-08 11:55:16 +01:00
Jeremy Allison
af2e4763bf CVE-2015-7560: s3: smbd: Refuse to set a POSIX ACL on a symlink.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11648

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2016-03-08 11:55:16 +01:00
Jeremy Allison
4be4e40788 CVE-2015-7560: s3: smbd: Refuse to set an ACL from a POSIX file handle on a symlink.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11648

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2016-03-08 11:55:16 +01:00
Jeremy Allison
e90c33e852 CVE-2015-7560: s3: smbd: Refuse to get an ACL from a POSIX file handle on a symlink.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11648

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2016-03-08 11:55:15 +01:00
Jeremy Allison
468f67b7ce CVE-2015-7560: s3: smbd: Add refuse_symlink() function that can be used to prevent operations on a symlink.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11648

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2016-03-08 11:55:15 +01:00
Christian Ambach
22126435d3 selftest: Add a blackbox test for smbget
Signed-off-by: Christian Ambach <ambi@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Christian Ambach <ambi@samba.org>
Autobuild-Date(master): Fri Feb 26 14:40:55 CET 2016 on sn-devel-144

(cherry picked from commit 39081afbe5f79192f6b42aa5670ebb757c98e875)

The last 11 patches address

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11767
removal of smbget -P option

Autobuild-User(v4-4-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-4-test): Fri Mar  4 14:55:10 CET 2016 on sn-devel-144
2016-03-04 14:55:10 +01:00
Christian Ambach
eb40cac8f3 selftest: add a helper for the smbget binary
Signed-off-by: Christian Ambach <ambi@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit 6ceba4def6641c94c794bb62b4c470c0ac60b83a)
2016-03-04 11:40:12 +01:00
Christian Ambach
83b29fb2b2 selftest: Reduce code duplication
Factor out a createuser sub.

Signed-off-by: Christian Ambach <ambi@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit 2588cf37c05d0247bb7a9ac9572b0ccf11c63ec0)
2016-03-04 11:40:12 +01:00
Christian Ambach
7ebf6603f5 s3:utils/smbget fix option parsing
* use proper values for val in poptOption
* popt does not support bool, so set them via the switch statement
* abort when option parsing reported errors

Signed-off-by: Christian Ambach <ambi@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit fcb56e0e1150f995823aff7dbcb0c09b87a39f6d)
2016-03-04 11:40:12 +01:00
Christian Ambach
789c77efd3 WHATSNEW: document removal of -P in smbget
Signed-off-by: Christian Ambach <ambi@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit dc0bd62a236e9d58370fb6d2be668f6a75f2998a)
2016-03-04 11:40:12 +01:00
Christian Ambach
a51b9a4b65 s3:utils/smbget update manpage with -P option removal
Signed-off-by: Christian Ambach <ambi@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit 301c69816c87c92184155a59814fd2d6652ea76e)
2016-03-04 11:40:12 +01:00
Christian Ambach
7ea03124cb s3:utils/smbget remove -P option
as agreed on samba-technical list.
It does not really provide a useful function but can cause confusion

Signed-off-by: Christian Ambach <ambi@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit dfc35044d81d413b03d5bf2b33c07c82a244ff57)
2016-03-04 11:40:11 +01:00
Christian Ambach
5298c3624c s3:utils/smbget improve check of write() result
check that all bytes in the buffer have been written

Signed-off-by: Christian Ambach <ambi@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit 113f8dd3d9e0d04b03b61f415b3c410ba75260f5)
2016-03-04 11:40:11 +01:00
Christian Ambach
b24f89890f s3:utils/smbget abort recursive download on error
Signed-off-by: Christian Ambach <ambi@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit 01ba35dca2f721fa5b3c31da7fa991e7d1479cc7)
2016-03-04 11:40:11 +01:00
Christian Ambach
ac81bbc130 s3:utils/smbget another int -> bool conversion
Signed-off-by: Christian Ambach <ambi@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit c91dde9caec39ac76d50602f8b32b6917dfeefba)
2016-03-04 11:40:11 +01:00
Robin Hack
52033ae75f samba3.blackbox.smbclient.forceuser_validusers: Add new test for force user option.
Test covers commit
cf0934caf282f4ade8c8a701b0e40b68a2f17ace

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9878
RH BUG: https://bugzilla.redhat.com/show_bug.cgi?id=1077651

How to test:
$ make -j test TESTS="samba3.blackbox.smbclient.forceuser_validusers"
RESULD: Should PASS
$ git revert cf0934caf282f4ade8c8a701b0e40b68a2f17ace
$ make -j test TESTS="samba3.blackbox.smbclient.forceuser_validusers"
RESULT: Should FAIL

Signed-off-by: Robin Hack <rhack@redhat.com>
Reviewed-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Uri Simchoni <uri@samba.org>
Autobuild-Date(master): Thu Feb  4 03:44:42 CET 2016 on sn-devel-144

(cherry picked from commit e2699685cad6fc341079ac4a677df8d6be26e9d9)
2016-03-04 11:40:11 +01:00
Uri Simchoni
e787720dce passdb: add linefeed to debug message
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11763

Signed-off-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Tue Mar  1 15:24:35 CET 2016 on sn-devel-144

(cherry picked from commit fb4778f4e9834af556bd5aac177fc04e7f09f152)
2016-03-04 11:40:11 +01:00
Uri Simchoni
1372a32700 smbd: ignore SVHDX create context
According to discussions with dochelp@microsoft.com, an SMB
server should ignore an SVHDX_OPEN_DEVICE_CONTEXT or
SVHDX_OPEN_DEVICE_CONTEXT_V2 create context if it does not
support the RSVD protocol. This is contrary to [MS-SMB2] rev 48.0
which states (3.3.5.9.14) that the open should fail in this case.

Failing the create fails Windows backup if the SMB dialect is
SMB3.0.2 or higher.

Hopefully a new revision of MS-SMB2 will clear this up in the future.

Meanwhile, this patch modifies smbd to ignore the
SVHDX_OPEN_DEVICE_CONTEXT by default. This can be overriden by a VFS
module if a VFS module adds support for RSVD.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11753

Signed-off-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Richard Sharpe <realrichardsharpe@gmail.com>
(cherry picked from commit c11ad90a240a7703e04d290f78c15839ba31d733)
2016-03-04 11:40:11 +01:00
Uri Simchoni
2335e6fa8f winbindd: return trust parameters when listing trusts
When asking a child domain process to list trusts on that domain,
return (along with trust domain names and SID) the trust properties -
flags, type, and attributes.

Use those attributes to initialize domain object.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11691

Signed-off-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Tue Feb 23 22:02:16 CET 2016 on sn-devel-144

(cherry picked from commit 7b4dfd939f417c7d8c4c2c1e8c77f4af9bcd28d7)
2016-03-04 11:40:11 +01:00
Uri Simchoni
46c12895fb winbindd: initialize foreign domain as AD based on trust
Based on trust parameters, initialize the active_directory
member of domain object to true.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11691

Signed-off-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit d0aa5d057497022aeefffa9882d3ac2b7e18a682)
2016-03-04 11:40:11 +01:00
Uri Simchoni
f9aef97053 winbindd: introduce add_trusted_domain_from_tdc()
This is purely a refactoring patch -
Add a routine that adds a winbindd domain object based on
domain trust cache entry. add_trusted_domain() becomes
a wrapper for this new routine.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11691

Signed-off-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit c65841a3bd737b61251603a916a315043703c832)
2016-03-04 11:40:11 +01:00
Alberto Maria Fiaschi
9004fa428c access based share enum: handle permission set in configuration files
change function is_enumeration_allowed to check  permissions set by
fields: valid users, invalid users, only user.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=8093

Signed-off-by: Alberto Maria Fiaschi <alberto.fiaschi@estar.toscana.it>
Reviewed-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit 5036a0922b7890005bcc8b77368a6635c8ebeb4b)
2016-03-04 11:40:11 +01:00
Stefan Metzmacher
bf4b42c101 tevent: version 0.9.28
* Fix memory leak when old signal action restored (bug #11742)

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Fri Feb 19 19:12:25 CET 2016 on sn-devel-144

(cherry picked from commit da74d0c317be9ce67eb5d00d232167d466f68a1e)
2016-03-04 11:40:11 +01:00
Jeremy Allison
c5b55c8bf9 lib: tevent: Fix memory leak reported by Pavel Březina <pbrezina@redhat.com> when old signal action restored.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11742

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Thu Feb 18 01:42:50 CET 2016 on sn-devel-144

(cherry picked from commit 833a2f474367624dd9980abb28227850e95fe976)
2016-03-04 11:40:11 +01:00
Stefan Metzmacher
77c1e14d63 tevent: version 0.9.27
* Fix bug in poll backend - poll_event_loop_poll()
  exits the for loop on POLLNVAL instead of
  continuing to find an event that is ready.
* Fix ETIME handling for Solaris event ports (bug #11728).

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>

Autobuild-User(master): Michael Adam <obnox@samba.org>
Autobuild-Date(master): Tue Feb 16 00:00:51 CET 2016 on sn-devel-144

(cherry picked from commit 2267faddfa9863b205dfad580fbd45182916cb32)
2016-03-04 11:40:11 +01:00
Nathan Huff
30d815ad4c Fix ETIME handling for Solaris event ports.
It is possible for port_getn to return -1 with errno set to ETIME and
still return events. If those events aren't processed the association is
lost by samba since the kernel dissacociated them and samba never
processed them so never reassociated them with the event port. The
patch checks the nget return value in the case of ETIME and if it is non
0 it doesn't return and goes through the event processing loop.

Signed-off-by: Nathan Huff <nhuff@acm.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Sun Feb  7 11:26:35 CET 2016 on sn-devel-144

(cherry picked from commit 4953b1f73f8ec9387516be1058434d71937e1447)
2016-03-04 11:40:11 +01:00
Michael Adam
30e85f4300 ldb: remove outdated comment about type argument in dlist
Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit d44f488317b431317963b42993cc56e2289a4d0d)
2016-03-04 11:40:11 +01:00
Michael Adam
96e0a11a89 tevent: remove outdated comment about type argument in dlist
Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 310da05710ed498b1657978286ca409ad8487161)
2016-03-04 11:40:10 +01:00
Michael Adam
745e81ed44 dlist: remove outdated comment about type argument
Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 025c59db066dc6d45beade963254b6be52e85f32)
2016-03-04 11:40:10 +01:00
Michael Adam
f20e5b3063 dlist: remove unneeded type argument from DLIST_CONCATENATE()
Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 2fd63ec80abd12a25ba652ff338c237c33668e33)
2016-03-04 11:40:10 +01:00
Michael Adam
ac360228b3 tevent: remove unneeded type argument from DLIST_CONCATENATE()
Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 0f6c00b6aef6ca824696a77d427248d0fa1aad04)
2016-03-04 11:40:10 +01:00
Michael Adam
95d89dda45 ldb: remove unneeded argument type from DLIST_CONCATENATE()
Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 1441824fe6a797e53fb182b00017a0f927ec42bf)
2016-03-04 11:40:10 +01:00
Michael Adam
9d32594753 tevent: remove uneeded type argument from DLIST_DEMOTE()
Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit be2a341d43158999667de90f7c84b6c21d6c5dc6)
2016-03-04 11:40:10 +01:00
Michael Adam
1a7ceca904 ldb: remove uneeded type argument from DLIST_DEMOTE()
Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit a1c5d662d4846a66f70d9a48b86fdda95264b30e)
2016-03-04 11:40:10 +01:00
Michael Adam
c3735243f7 dlist: remove unneeded argument from DLIST_DEMOTE()
Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit d6f5fc8c2d3db3daa2209850ef0487e822c7bb92)
2016-03-04 11:40:10 +01:00
Michael Adam
9e06f33d39 ldb: remove unneeded type arg from DLIST_ADD_END
Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 66af807fc45114d422d73c751a94e72117555113)
2016-03-04 11:40:10 +01:00
Michael Adam
2081969a4a tevent: remove unneeded type argument from DLIST_ADD_END
Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit a091c0ac6891a1ec3e15af7808a9c19533bcfb7c)
2016-03-04 11:40:10 +01:00
Michael Adam
c4536f8cb4 dlist: remove unneeded type argument from DLIST_ADD_END()
Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 476672b647e44898a6de8894b23e598ad13b1fcf)
2016-03-04 11:40:10 +01:00
Stefan Metzmacher
c17b1f697c s3:clispnego: fix confusing warning in spnego_gen_krb5_wrap()
asn1_extract_blob() stops further asn1 processing by setting has_error.

Don't call asn1_has_error() after asn1_extract_blob() has been successful
otherwise we get an "Failed to build krb5 wrapper at" message
on success.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11702

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
(cherry picked from commit 14f1a94b6fb3a55be1e60fe0d28740f04fd94b3f)
2016-03-04 11:40:10 +01:00
Stefan Metzmacher
6342580047 s3:libads: setup the msDS-SupportedEncryptionTypes attribute on ldap_add
We may not have the permission to modify the object after creation.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11755

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Björn Jacke <bj@sernet.de>
Reviewed-by: Günther Deschner <gd@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Fri Feb 26 11:30:03 CET 2016 on sn-devel-144

Autobuild-User(v4-4-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-4-test): Mon Feb 29 14:35:08 CET 2016 on sn-devel-144
2016-02-29 14:35:07 +01:00