1
0
mirror of https://github.com/samba-team/samba.git synced 2025-02-03 13:47:25 +03:00

120686 Commits

Author SHA1 Message Date
Martin Schwenke
93fc31858f ctdb-tests: Add local_daemons.sh option for recovery lock recheck interval
Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
2020-01-21 11:39:40 +00:00
Gary Lockyer
13658324a3 CVE-2019-19344 kcc dns scavenging: Fix use after free in dns_tombstone_records_zone
ldb_msg_add_empty reallocates the underlying element array, leaving
old_el pointing to freed memory.

This patch takes two defensive copies of the ldb message, and performs
the updates on them rather than the ldb messages in the result.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=14050

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>

Autobuild-User(master): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(master): Tue Jan 21 11:38:38 UTC 2020 on sn-devel-184
2020-01-21 11:38:38 +00:00
Andrew Bartlett
34a8cee348 CVE-2019-14907 lib/util: Do not print the failed to convert string into the logs
The string may be in another charset, or may be sensitive and
certainly may not be terminated.  It is not safe to just print.

Found by Robert Święcki using a fuzzer he wrote for smbd.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14208
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2020-01-21 10:11:39 +00:00
Andrew Bartlett
86023642c3 repl_meta_data: Only reset replMetaData entry for name if we made a conflict name here
We previously set it for any rename

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2020-01-21 10:11:39 +00:00
Andrew Bartlett
9e126852a6 repl_meta_data: Do not set *rename = true unless there has been a conflict on the incoming DN
The normal case of a partner-sent rename is not a cause for updating the replPropertyMetaData

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2020-01-21 10:11:39 +00:00
Andrew Bartlett
512ea17983 repl_meta_data: Add comment explaining what is being renamed after the conflict is resolved
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2020-01-21 10:11:39 +00:00
Andrew Bartlett
2b1828276b CVE-2019-14902 dsdb: Change basis of descriptor module deferred processing to be GUIDs
We can not process on the basis of a DN, as the DN may have changed in a rename,
not only that this module can see, but also from repl_meta_data below.

Therefore remove all the complex tree-based change processing, leaving only
a tree-based sort of the possible objects to be changed, and a single
stopped_dn variable containing the DN to stop processing below (after
a no-op change).

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12497

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2020-01-21 10:11:38 +00:00
Andrew Bartlett
b7030f9a8b CVE-2019-14902 repl_meta_data: Set renamed = true (and so do SD inheritance) after any rename
Previously if there was a conflict, but the incoming object would still
win, this was not marked as a rename, and so inheritence was not done.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12497

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2020-01-21 10:11:38 +00:00
Andrew Bartlett
4c62210098 CVE-2019-14902 repl_meta_data: Fix issue where inherited Security Descriptors were not replicated.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12497

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2020-01-21 10:11:38 +00:00
Andrew Bartlett
520d2ae187 CVE-2019-14902 repl_meta_data: schedule SD propagation to a renamed DN
We need to check the SD of the parent if we rename, it is not the same as an incoming SD change.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12497

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2020-01-21 10:11:38 +00:00
Andrew Bartlett
3f3791765c CVE-2019-14902 dsdb: Ensure we honour both change->force_self and change->force_children
If we are renaming a DN we can be in a situation where we need to

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12497

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2020-01-21 10:11:38 +00:00
Andrew Bartlett
5d714c1cea CVE-2019-14902 dsdb: Add comments explaining why SD propagation needs to be done here
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12497

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2020-01-21 10:11:38 +00:00
Andrew Bartlett
545d205e5b CVE-2019-14902 dsdb: Explain that descriptor_sd_propagation_recursive() is proctected by a transaction
This means we can trust the DB did not change between the two search
requests.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12497

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2020-01-21 10:11:38 +00:00
Andrew Bartlett
febe15ab2e selftest: Add test to confirm ACL inheritence really happens
While we have a seperate test (sec_descriptor.py) that confirms inheritance in
general we want to lock in these specific patterns as this test covers
rename.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2020-01-21 10:11:38 +00:00
Andrew Bartlett
d64670bab8 CVE-2019-14902 selftest: Add test for a special case around replicated renames
It appears Samba is currently string-name based in the ACL inheritence code.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12497

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2020-01-21 10:11:38 +00:00
Andrew Bartlett
7b19e221ae CVE-2019-14902 selftest: Add test for replication of inherited security descriptors
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12497

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2020-01-21 10:11:38 +00:00
Martin Schwenke
558bd7c83d util: Add detection of libunwind
The current detection doesn't seem to work, so libunwind doesn't seem
to be used.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Volker Lendecke <vl@samba.org>

Autobuild-User(master): Martin Schwenke <martins@samba.org>
Autobuild-Date(master): Tue Jan 21 08:12:17 UTC 2020 on sn-devel-184
2020-01-21 08:12:17 +00:00
Martin Schwenke
5ff83809a2 s3: lib: dbwrap_ctdb: Ensure value_valid is set when creating empty record
Fixes:

  PANIC: assert failed at ../../lib/dbwrap/dbwrap.c(82): rec->value_valid
  PANIC (pid 902392): assert failed: rec->value_valid
  BACKTRACE: 16 stack frames:
   #0 bin/shared/libsamba-util.so.0(log_stack_trace+0x30) [0x7fb161f69cb0]
   #1 bin/shared/libsmbconf.so.0(smb_panic_s3+0x23) [0x7fb1619f4863]
   #2 bin/shared/libsamba-util.so.0(smb_panic+0x2f) [0x7fb161f69daf]
   #3 bin/shared/private/libdbwrap-samba4.so(dbwrap_record_get_value+0x27) [0x7fb160a04c57]
   #4 bin/shared/libsamba-passdb.so.0(+0x2d27c) [0x7fb1618e627c]
   #5 bin/shared/libsamba-passdb.so.0(pdb_add_aliasmem+0x33) [0x7fb1618db663]
   #6 bin/shared/libsamba-passdb.so.0(+0x1edbb) [0x7fb1618d7dbb]
   #7 bin/shared/libsamba-passdb.so.0(create_builtin_administrators+0x167) [0x7fb1618d8217]
   #8 bin/shared/private/libauth-samba4.so(finalize_local_nt_token+0x39d) [0x7fb16194bd5d]
   #9 bin/shared/private/libauth-samba4.so(create_local_nt_token_from_info3+0x304) [0x7fb16194c3f4]
   #10 bin/shared/private/libauth-samba4.so(create_local_token+0x3d6) [0x7fb161945106]
   #11 bin/shared/private/libauth-samba4.so(+0x154b4) [0x7fb1619474b4]
   #12 bin/shared/private/libauth-samba4.so(init_guest_session_info+0x58) [0x7fb161947798]
   #13 ./bin/smbd(main+0x80f) [0x55944ef8f91f]
   #14 /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xeb) [0x7fb161076bbb]
   #15 ./bin/smbd(_start+0x2a) [0x55944ef90f8a]

This is a similar, additional fix to commit
36ea1e188d5ea8d40c47ffc466a494c1160e471c.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Mon Jan 20 04:25:57 UTC 2020 on sn-devel-184
2020-01-20 04:25:57 +00:00
Volker Lendecke
4dd026d0d3 smbd: Fix claiming version
We now have to do an explicit DOWNGRADE when we want to change from
G_LOCK_WRITE to G_LOCK_READ.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Sun Jan 19 19:58:01 UTC 2020 on sn-devel-184
2020-01-19 19:58:01 +00:00
Volker Lendecke
25bcf0e789 lib: Use closefrom() in smbrun.c
INSURE is never defined or used.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-01-19 18:29:39 +00:00
Volker Lendecke
42a3e2e503 ctdbd: Use struct initialization
2 lines less

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-01-19 18:29:39 +00:00
Volker Lendecke
b274bc698e dsdb: Use write_data() to write to the password check script
A simple write() might be interrupted or do short writes. Highly
unlikely, but if it happens, it will be impossible to diagnose.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-01-19 18:29:39 +00:00
Volker Lendecke
229518ec01 dsdb: Align integer types
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-01-19 18:29:39 +00:00
Volker Lendecke
37eb87d2be lib: Align integer types
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-01-19 18:29:39 +00:00
Andrew Bartlett
cffcc39f18 heimdal_build: Remove bashism from --address-sanitizer build rule
export FOO=bar is a Bash extension, and is not required in this case, we only need the asn1_compile
to run under the variable, there are no further commands in this sub-shell.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Isaac Boukris <iboukris@samba.org>

Autobuild-User(master): Isaac Boukris <iboukris@samba.org>
Autobuild-Date(master): Sat Jan 18 12:25:16 UTC 2020 on sn-devel-184
2020-01-18 12:25:16 +00:00
Ralph Boehme
7606800b79 smbd: avoid calling vfs_file_id_from_sbuf() if statinfo is not valid
When we're about to create a file, the stat info will be all zero, so
vfs_file_id_from_sbuf() would return a bogus file_id. This is normally not a
problem, as open_file() itself also calls vfs_file_id_from_sbuf() after having
created the file.

This is however a problem when using the VFS module fileid, as that is doing
caching of /etc/mtab and failing to find smb_fname->st.st_ex_dev (all zero in
this case when creating a new file) in the mtab cache will trigger a mtab reload
which can be *very* expensive.

Copying many small files to a Samba server in this situation will result in
abysimal performance.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14237

Pair-Programmed-With: Jeremy Allison <jra@samba.org>
Signed-off-by: Ralph Boehme <slow@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Fri Jan 17 22:38:14 UTC 2020 on sn-devel-184
2020-01-17 22:38:14 +00:00
Anoop C S
c9adf47ac5 vfs_glusterfs: Return fake fd from pipe() during open
GlusterFS currently doesn't have an API implementation to set flags on
open file descriptor. Thus we use pipe() to provide valid file descriptor
from the system.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14241

Signed-off-by: Anoop C S <anoopcs@redhat.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>

Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Fri Jan 17 17:14:43 UTC 2020 on sn-devel-184
2020-01-17 17:14:43 +00:00
Douglas Bagnall
6c7b722b3f fuzz_oLschema2ldif: check multiple possible NULLs
Address sanitizer will object to a theoretically possible NULL dereference
so we can't ignore these checks in set-up.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Fri Jan 17 14:33:18 UTC 2020 on sn-devel-184
2020-01-17 14:33:18 +00:00
Douglas Bagnall
6786ec2c96 fuzzing: check for NULL on ldb_init()
We simply return 0 because failure here is not a problem with the code we
are actually trying to fuzz. Without this asan is unhappy.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>
2020-01-17 12:59:35 +00:00
Günther Deschner
75367e4b06 librpc: add clusapi_GroupSetControlCode enum
Guenther

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Jan 16 21:34:27 UTC 2020 on sn-devel-184
2020-01-16 21:34:27 +00:00
Günther Deschner
ac5b742702 s4-torture: increase various bufsizes to better deal with Windows 2019 clusters
Guenther

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-01-16 20:09:42 +00:00
Günther Deschner
83bbc5cc42 s4-torture: fix copy/paste error in clusapi group test
Guenther

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-01-16 20:09:42 +00:00
Günther Deschner
edf21f5e30 s4-torture: add clusapi GroupSet tests
Guenther

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-01-16 20:09:42 +00:00
Günther Deschner
21157c66ab s4-torture: fix asserts in clusapi_NodeControl tests
Guenther

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-01-16 20:09:42 +00:00
Günther Deschner
efe353edf4 s4-torture: save cluster version in clusapi test context
Guenther

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-01-16 20:09:42 +00:00
Günther Deschner
8dca8aaf95 librpc: add various new clusapi functions and types
Guenther

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-01-16 20:09:42 +00:00
Douglas Bagnall
4bc481c5cb samba-tool gpo: improve UNC parsing
The "UNC doesn't start with \\\\ or //" message was unreachable due to
a logic error, and an UNC starting with \\ would have been split on
/ if there were enough /s in the string.

The unreachable exception was first noticed by Gerhard Lausser in a
github pull request (https://github.com/samba-team/samba/pull/123),
but that patch no longer applies with this more thorough rewrite.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-01-16 20:09:42 +00:00
Volker Lendecke
ebced94a87 torture: Test smbcontrol close-denied-share
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Wed Jan 15 22:51:14 UTC 2020 on sn-devel-184
2020-01-15 22:51:14 +00:00
Volker Lendecke
5394885167 smbd: Add close-denied-share message
This is like close-share, but kicks out only active users where share
access controls are changed such that now access would be denied

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-01-15 21:25:35 +00:00
Volker Lendecke
c9850e3d80 smbd: Move sharename check of conn_force_tdis() into a callback
Next commit will have an additional check

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-01-15 21:25:34 +00:00
Volker Lendecke
733f798074 texpect: Avoid duplicate sys_write()
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-01-15 21:25:34 +00:00
Volker Lendecke
4fabe1d107 texpect: Reformat long line
There will be more deps soon

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-01-15 21:25:34 +00:00
Volker Lendecke
4371982619 texpect: Use lib/replace's closefrom()
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-01-15 21:25:34 +00:00
Samuel Cabrero
2198da1b9b s3:libsmb: Fix querying all names registered within broadcast area
Wait for additional replies until timeout when '*' is given to nmblookup
as name.

Introduced by 8da8c36b53cc115f0d446b666fc24fc9423d808e.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=8927

Signed-off-by: Samuel Cabrero <scabrero@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-01-15 21:25:34 +00:00
Douglas Bagnall
0fcc2e9319 fuzz: add nmblib/parse_packet target
We want to ensure that parse_packet() can parse a packet without
crashing, and that that parsed packet won't cause trouble further down
the line.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>

Autobuild-User(master): Gary Lockyer <gary@samba.org>
Autobuild-Date(master): Wed Jan 15 21:24:31 UTC 2020 on sn-devel-184
2020-01-15 21:24:31 +00:00
Douglas Bagnall
f4bafcca86 fuzz: ldb binary decode/enode
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2020-01-15 19:58:41 +00:00
Douglas Bagnall
da4786003f fuzz: add ldb ldif fuzzer
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2020-01-15 19:58:41 +00:00
Douglas Bagnall
13bd82db64 fuzz: ldb_dn parsing
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2020-01-15 19:58:41 +00:00
Gary Lockyer
79460b1b9f lib ldb common: Fix memory leak
TALLOC_FREE the ldb_control allocated in ldb_parse_control_from_string
when none of the cases match.

Credit to OSS-Fuzz

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: David Disseldorp <ddiss@samba.org>
ldb-2.1.0
2020-01-15 19:58:41 +00:00
Björn Baumbach
6b8a683884 tests: Test samba-tool user setprimarygroup command
Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Wed Jan 15 13:30:53 UTC 2020 on sn-devel-184
2020-01-15 13:30:53 +00:00