1
0
mirror of https://github.com/samba-team/samba.git synced 2025-02-04 17:47:26 +03:00

5330 Commits

Author SHA1 Message Date
Stefan Metzmacher
8ff6a955f5 CVE-2016-2115: docs-xml: add "client ipc min protocol" and "client ipc max protocol" options
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11796

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2016-04-12 19:25:26 +02:00
Stefan Metzmacher
6ad9ba72a7 CVE-2016-2113: docs-xml: let "tls verify peer" default to "as_strict_as_possible"
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11752

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
2016-04-12 19:25:25 +02:00
Stefan Metzmacher
2362c0353b CVE-2016-2113: docs-xml: add "tls verify peer" option defaulting to "no_check"
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11752

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
2016-04-12 19:25:25 +02:00
Stefan Metzmacher
6e22abd977 CVE-2016-2112: docs-xml: change the default of "ldap server require strong auth" to "yes"
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11644

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
2016-04-12 19:25:25 +02:00
Stefan Metzmacher
0cd2acef79 CVE-2016-2112: docs-xml: add "ldap server require strong auth" option
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11644

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
2016-04-12 19:25:25 +02:00
Stefan Metzmacher
1dc40a08f0 CVE-2016-2111: docs-xml/smbdotconf: default "raw NTLMv2 auth" to "no"
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11749

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
2016-04-12 19:25:24 +02:00
Stefan Metzmacher
a1900b5bd6 CVE-2016-2111: docs-xml: add "raw NTLMv2 auth" defaulting to "yes"
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11749

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
2016-04-12 19:25:24 +02:00
Volker Lendecke
e6ed803a3b tdb mutex check: Fix CID 1358473 Uninitialized scalar variable
This comes via a "goto cleanup" before suspend_mask is initialized

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>

Autobuild-User(master): Uri Simchoni <uri@samba.org>
Autobuild-Date(master): Tue Apr 12 11:39:35 CEST 2016 on sn-devel-144
2016-04-12 11:39:34 +02:00
Stefan Metzmacher
acf6deb698 tdb: version 1.3.9
* avoid a race condition when checking for robust mutexes
  (bug #11808)
* Remove use of strcpy in tdb test.
* eliminate deprecation warnings in python tests
* Only set public headers field when installing as a public library.
* Refuse to load a database with hash size 0
* Fix various spelling errors

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Mon Apr 11 18:48:26 CEST 2016 on sn-devel-144
2016-04-11 18:48:26 +02:00
Uri Simchoni
ef3d837040 tdb: rework cleanup logic in tdb_runtime_check_for_robust_mutexes()
The cleanup logic used six goto lables, at least I'm not able to make
sane modifications to such a beast.

By using state flags that track which objects are initialized and need
cleanup, we get rid of the goto labels. It comes at a cost though: you
have to be careful to correctly set the cleanup flags.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2016-04-11 15:22:26 +02:00
Volker Lendecke
ff6b49beeb nwrap: Fix the build on Solaris
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11816

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Tue Apr  5 08:57:06 CEST 2016 on sn-devel-144
2016-04-05 08:57:06 +02:00
Jeremy Allison
0da76c9ab8 lib:replace: Missing semicolon on function definition.
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Martin Schwenke <martin@meltin.net>

Autobuild-User(master): Martin Schwenke <martins@samba.org>
Autobuild-Date(master): Sat Apr  2 06:04:13 CEST 2016 on sn-devel-144
2016-04-02 06:04:13 +02:00
Christof Schmitt
6a2d97b361 gpfswrap: Add wrapper for gpfs_set_winattrs
Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2016-04-01 19:28:23 +02:00
Ralph Boehme
a7a77e2f43 tdb: avoid a race condition when checking for robust mutexes
This fixes a race between calling waitpid() in two places (SIGCHLD the
signal handler and the rendezvous code when waiting for the child to
terminate), by

- blocking SIGCHLD before installing our signal handler

- in the rendezvous code call sigssuspend() which unblocks SIGCHLD and
  suspends the thread and waits for signal delivery

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11808

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>

Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Tue Mar 29 16:04:19 CEST 2016 on sn-devel-144
2016-03-29 16:04:19 +02:00
Uri Simchoni
644e697fab lib/util: fix function comment
Signed-off-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2016-03-28 20:45:16 +02:00
Douglas Bagnall
a20ee62984 tevent.h: use HAVE___ATTRIBUTE__ instead of __GNUC__
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2016-03-24 15:13:15 +01:00
Douglas Bagnall
6ba2fe2e3f libreplace: use HAVE___ATTRIBUTE__ instead of __GNUC__
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2016-03-24 15:13:15 +01:00
Douglas Bagnall
88be24c279 util/attr.h: use HAVE___ATTRIBUTE__, not __GNUC__ comparisons
The comparisons that look like

    #if (__GNUC__ >= 3) && (__GNUC_MINOR__ >= 1 )

fail if __GNUC_MINOR__ is 0.  The intended comparison is something
more like

    #if __GNUC__ > 3 || (__GNUC__ == 3 && __GNUC_MINOR__ >= 1)

However, given that:

 * these checks are really trying to test the presence of
   __attribute__,

 * there are now credible compilers that are not GCC, which have
   __attribute__ but might not be good at emulating __GNUC__
   numbers, and

 * we really face little risk of running into GCC 2.95

 * we have a HAVE___ATTRIBUTE__ check in ./configure

let's not do the version comparisons.

(Untested on GCC 2.95, GCC 3.0 and GCC 3.1).

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2016-03-24 15:13:15 +01:00
Douglas Bagnall
5e4f39ad60 ldb_controls: avoid unnecessary unchecked talloc_asprintf()s
The error paths when a control doesn't parse involved a lot of
talloc_asprintf()s and talloc_asprintf_append()s but almost no actual
printf formatting. The return values were not checked. This replaces
them with constant strings.

The one case that did use formatting looked like this:

 "invalid %s control syntax\n",  LDB_CONTROL_DIRSYNC_EX_NAME

and that has been replaced with

  "invalid dirsync_ex control syntax\n"

in line with the way it is done elsewhere.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-03-22 08:00:32 +01:00
Douglas Bagnall
bd6a0220f4 ldb controls: allow paged_search to use a cookie
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-03-22 08:00:32 +01:00
Douglas Bagnall
7bd06613da ldb client controls: don't ignore failed memdup
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-03-22 08:00:31 +01:00
Douglas Bagnall
578643fb36 ldb controls: don't ignore memory allocation failure
Thanks to Jeremy Allison for noticing this.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-03-22 08:00:31 +01:00
Garming Sam
cd594a3cb3 sort: enable custom behaviour on critical control
The sort module should simply return unsorted results when a sort is
unsupported but not critical. A similar custom behaviour should be
expected with VLV pagination when it is enabled.

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-03-22 08:00:31 +01:00
Jeremy Allison
a559ac31f7 lib:tdb: Remove use of strcpy in tdb test.
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Martin Schwenke <martin@meltin.net>
2016-03-22 04:38:24 +01:00
Günther Deschner
c5c3f91c6f lib/torture: add torture_assert_u64_not_equal_goto macro
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2016-03-22 00:23:21 +01:00
Andreas Schneider
b9d93e7187 lib: Update nss_wrapper to version 1.1.3
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2016-03-22 00:23:20 +01:00
Andreas Schneider
9e8876a9d7 lib: Update uid_wrapper to version 1.2.1
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2016-03-22 00:23:20 +01:00
Andreas Schneider
092d6f9ec1 lib: Update socket_wrapper to version 1.1.6
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2016-03-22 00:23:20 +01:00
Douglas Bagnall
e806824fc8 ldb client controls: avoid talloc_memdup(x, y, (size_t)-1);
ldb_base64_decode() returns -1 if a string can't be parsed as base64,
and this is not the kind of value you want to use in talloc_memdup().

In these cases it can happen innocently if the strings are truncated
to fit in their buffers.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by:  Volker Lendecke <Volker.Lendecke@SerNet.DE>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Sat Mar 19 00:56:42 CET 2016 on sn-devel-144
2016-03-19 00:56:42 +01:00
Volker Lendecke
a243a9012f lib: Fix CID 1356315 Dereference before null check
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2016-03-18 00:29:14 +01:00
Andreas Schneider
2467032a3e krb5-wrap: Use the principal returned by the KDC to create the ccache
We request a TGT in uppercase from the KDC. We turned on
canonicalization for that so the KDC returns the principal in lowercase
cause of this. As we use the uppercase prinicpal to create the ccache we
fail to find the tickets we need later because it is stored in the
incorrect case. You have to use the princial returned by the KDC here.

Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
Reviewed-by: Sumit Bose <sbose@redhat.com>
Reviewed-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-03-17 04:32:27 +01:00
Stefan Metzmacher
e55806e83e ldb-samba:wscript: python_samba__ldb depends on pyauth
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11789

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Wed Mar 16 01:34:29 CET 2016 on sn-devel-144
2016-03-16 01:34:29 +01:00
Günther Deschner
2e2f81134c lib/socket/interfaces: Fix some uninitialied bytes.
Valgrind reports the following:

==26599== Syscall param ioctl(SIOCETHTOOL) points to uninitialised byte(s)
==26599==    at 0x7014707: ioctl (in /usr/lib64/libc-2.22.so)
==26599==    by 0x79D1585: query_iface_speed_from_name (interfaces.c:152)
==26599==    by 0x79D1BBA: _get_interfaces (interfaces.c:277)
==26599==    by 0x79D1E80: get_interfaces (interfaces.c:368)
==26599==    by 0x508A7E3: load_interfaces (interface.c:612)
==26599==    by 0x150B30: main (net.c:963)
==26599==  Address 0xffefff0d8 is on thread 1's stack
==26599==  in frame #1, created by query_iface_speed_from_name
(interfaces.c:130)
==26599==
==26599== Syscall param ioctl(SIOCETHTOOL) points to uninitialised byte(s)
==26599==    at 0x7014707: ioctl (in /usr/lib64/libc-2.22.so)
==26599==    by 0x79D15CC: query_iface_speed_from_name (interfaces.c:164)
==26599==    by 0x79D1BBA: _get_interfaces (interfaces.c:277)
==26599==    by 0x79D1E80: get_interfaces (interfaces.c:368)
==26599==    by 0x508A7E3: load_interfaces (interface.c:612)
==26599==    by 0x150B30: main (net.c:963)
==26599==  Address 0xffefff0d8 is on thread 1's stack
==26599==  in frame #1, created by query_iface_speed_from_name
(interfaces.c:130)

Guenther

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2016-03-12 06:24:24 +01:00
Stefan Metzmacher
6400bbb5ee lib/util_net: add support for .ipv6-literal.net
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-03-10 06:52:26 +01:00
Stefan Metzmacher
771042a238 lib/util_net: move ipv6 linklocal handling into interpret_string_addr_internal()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-03-10 06:52:26 +01:00
Andreas Schneider
c2f5c30bea krb5_wrap: Add smb_krb5_open_keytab_relative() function
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2016-03-10 06:52:25 +01:00
Andreas Schneider
4e367288a5 krb5_wrap: Move smb_krb5_kt_add_entry() to krb5_wrap
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2016-03-10 06:52:25 +01:00
Andreas Schneider
1e1e12a825 s3-libads: Pass down the salt principal in smb_krb5_kt_add_entry()
This is a preparation to move smb_krb5_kt_add_entry() to krb5_wrap.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2016-03-10 06:52:25 +01:00
Douglas Bagnall
5d6a67e9de ldb sort: allow sorting on attributes not returned in search
The attribute is added to the search request, then peeled off again
before the sort module passes the results on.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-03-09 10:32:17 +01:00
Douglas Bagnall
577f972f45 ldb_controls: add base64 option to VLV
The Samba control syntax limits the range of valid search terms for
VLV's gt_eq mode. To get around that, we allow base64 encoded strings
using the syntax 'base64>=Zm9vCg==' rather than '>=foo'.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-03-09 10:32:16 +01:00
Douglas Bagnall
9bbd7d1c77 asn1: make readContextSimple() add a NUL byte
Pair-programmed-with: Garming Sam <garming@catalyst.net.nz>
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-03-09 10:32:16 +01:00
Douglas Bagnall
16fda12282 ldb controls: use uint8_t* for contextID binary blob
It is never a readable string.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-03-09 10:32:16 +01:00
Douglas Bagnall
8ca1e349eb ASN1: use a talloc context in read_contextSimple
Pair-programmed-with: Garming Sam <garming@catalyst.net.nz>
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-03-09 10:32:16 +01:00
Douglas Bagnall
177ca764fc vlv: better syntax for parsing greater than or equal strings
This makes the gt_eq case different from the indexed case in the eyes
of sscanf().

Pair-programmed-with: Garming Sam <garming@catalyst.net.nz>
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-03-09 10:32:16 +01:00
Douglas Bagnall
78f8a89bdd ldb controls: better error string for VLV control
Pair-programmed-with: Garming Sam <garming@catalyst.net.nz>
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-03-09 10:32:16 +01:00
Garming Sam
2973d4cd0f ldb controls: base64 encode VLV response context strings
Pair-programmed-with: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-03-09 10:32:16 +01:00
Douglas Bagnall
182c87fb82 ldb paged_results: quieten a warning.
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-03-09 10:32:16 +01:00
Andrew Bartlett
4c38e74d7c dsdb: Introduce LDB_SYNTAX_SAMBA_OCTET_STRING
The sort order for this function is more expected than the sort order for
ldb_comparsion_binary()

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-03-09 10:32:16 +01:00
Douglas Bagnall
407c812b2a util/tests: add test for BINARY_ARRAY_SEARCH_V macro
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-03-09 10:32:16 +01:00
Douglas Bagnall
5235f1facf util/binsearch: macro for greater than or equal search
Sometimes you want to find the place where an item would be in a
sorted list, whether or not it is actually there.

The BINARY_ARRAY_SEARCH_GTE macro takes an extra 'next' pointer
argument over the other binsearch macros. This will end up pointing to
the next element in the case where there is not an exact match, or
NULL when there is. That is, searching the list

     { 2, 3, 4, 4, 9}

with a standard integer compare should give the following results:

search term    *result    *next
         1      -          2
         3      3          -
         4      4 [1]      -
         7      -          9
         9      9          -
        10      -          - [2]

Notes
[1] There are two fours, but you will always get the first one.
[2] The both NULL case means the search term is beyond the last list
item.

You can safely use the same pointer for both 'result' and 'next', if
you don't care to distinguish between the 'greater-than' and 'equals'
cases.

There is a torture test for this.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-03-09 10:32:16 +01:00