1
0
mirror of https://github.com/samba-team/samba.git synced 2025-02-03 13:47:25 +03:00

120060 Commits

Author SHA1 Message Date
Volker Lendecke
51f16ec578 librpc: Fix CID 1455913 Use after free
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2019-11-19 16:13:36 +00:00
Isaac Boukris
d2b5aa1650 whatsnew: announce removal of DES encryption type in Kerberos
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14202

Signed-off-by: Isaac Boukris <iboukris@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Isaac Boukris <iboukris@samba.org>
Autobuild-Date(master): Tue Nov 19 16:12:39 UTC 2019 on sn-devel-184
2019-11-19 16:12:39 +00:00
Isaac Boukris
389d1b979b heimdal: do not compile weak crypto
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14202

Signed-off-by: Isaac Boukris <iboukris@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-11-19 14:48:41 +00:00
Isaac Boukris
a53fa8ffe3 selftest: allow any kdc error in mitm-s4u2self test
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14202

Signed-off-by: Isaac Boukris <iboukris@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-11-19 14:48:41 +00:00
Isaac Boukris
151f8c0f31 selftest: mitm-s4u2self: use zlib for CRC32_checksum calc
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14202

Signed-off-by: Isaac Boukris <iboukris@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-11-19 14:48:41 +00:00
Isaac Boukris
88bf0c5720 machine_account_secrets: do not generate single DES keys
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14202

Signed-off-by: Isaac Boukris <iboukris@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-11-19 14:48:41 +00:00
Isaac Boukris
80f1901de0 kerberos_keytab: do not add single DES keys to keytab
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14202

Signed-off-by: Isaac Boukris <iboukris@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-11-19 14:48:41 +00:00
Isaac Boukris
982aa328f6 password_hash: do not generate single DES keys
Per RFC-6649 single DES enctypes should not be used.

MIT has retired single DES encryption types, see:
https://web.mit.edu/kerberos/krb5-1.12/doc/admin/advanced/retiring-des.html

As a workaround, store random keys instead, making the usage of signle DES
encryption types virtually impossible.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14202

Signed-off-by: Isaac Boukris <iboukris@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-11-19 14:48:41 +00:00
Isaac Boukris
e8015d8a34 kdc/db-glue: do not fetch single DES keys from db
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14202

Signed-off-by: Isaac Boukris <iboukris@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-11-19 14:48:41 +00:00
Isaac Boukris
ad9016d579 kerberos: remove single DES enctypes from ENC_ALL_TYPES
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14202

Signed-off-by: Isaac Boukris <iboukris@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-11-19 14:48:41 +00:00
Isaac Boukris
13655e59e2 selftest: exclude msDS-SupportedEncryptionType in ldapcmp
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14202

Pair-Programmed-With: Alexander Bokovoy <ab@samba.org>

Signed-off-by: Isaac Boukris <iboukris@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-11-19 14:48:41 +00:00
Isaac Boukris
41b40f0e55 selftest/remote_pac: remove test_PACVerify_workstation_des
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14202

Signed-off-by: Isaac Boukris <iboukris@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-11-19 14:48:41 +00:00
Andrew Bartlett
42ac80fb46 ndr: Include the caller location in ndr_{pull,push}_error() messages
This should aid in debugging NDR parse failures.

Use the ABI bump to again exclude ndr_table_misc incorrectly
added in ABI 0.2.1.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Tue Nov 19 14:47:46 UTC 2019 on sn-devel-184
2019-11-19 14:47:46 +00:00
Andrew Bartlett
183da1f9fd witness.idl: Change array type in IDL for the print function
It is important that the generated print function checks r->messages
before de-referencing r->messages[num] as r->num can be non-zero
while r->messages is NULL.

There is not witness server in Samba and print functions are only
used during debugging and ndrdump in any case.

The change in the IDL does not change the header and the IDL
function is already nopull,nopush so only the print function changes.

Found by Douglas Bagnall using Honggfuzz and a new fuzzer for
Samba's NDR layer.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2019-11-19 13:21:29 +00:00
Robert Scott
c34ec003b7 utils: only compile test_oLschema2ldif if fmemopen exists
in the vein of da87fa998ab71328f30bcdf5b41aee8675aee48a

Signed-off-by: Robert Scott <code@humanleg.org.uk>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Tue Nov 19 06:12:29 UTC 2019 on sn-devel-184
2019-11-19 06:12:29 +00:00
Andreas Schneider
71816984c3 s4:lib:tls: Fix cert and privkey types
../../source4/lib/tls/tlscert.c:42:2: warning: ‘gnutls_x509_crt’ is
    deprecated [-Wdeprecated-declarations]
   42 |  gnutls_x509_crt cacrt, crt;
      |  ^~~~~~~~~~~~~~~
../../source4/lib/tls/tlscert.c:43:2: warning: ‘gnutls_x509_privkey’ is
    deprecated [-Wdeprecated-declarations]
   43 |  gnutls_x509_privkey key, cakey;
      |  ^~~~~~~~~~~~~~~~~~~

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-11-19 04:48:29 +00:00
Andreas Schneider
e19b115dd2 libcli:auth: Remove unused E_md5hash()
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14195

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-11-19 04:48:29 +00:00
Andreas Schneider
4199d1040f s3:winbind: Replace E_md5hash() with GnuTLS calls
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14195

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-11-19 04:48:29 +00:00
Andreas Schneider
10499507c4 s3:winbindd: Replace E_md5hash() with GnuTLS calls
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14195

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-11-19 04:48:29 +00:00
Andreas Schneider
a377214dce s3:rpc_server: Replace E_md5hash() with GnuTLS calls
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14195

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-11-19 04:48:29 +00:00
Amitay Isaacs
93b9fc3da8 build: add missing crypt dependency for auth4_unix
Commit dc5788056bc removed crypt library from replace.  This breaks the
build on fedora 30 ppc64.

  [2439/3956] Linking bin/default/source4/auth/ntlm/libauth4-samba4.so
  /usr/bin/ld: source4/auth/ntlm/auth_unix.c.5.o: in function `password_check':
  auth_unix.c:(.text+0x7e0): undefined reference to `crypt'

crypt library is required to build ntlm auth_unix.c.

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Amitay Isaacs <amitay@samba.org>
Autobuild-Date(master): Tue Nov 19 04:47:47 UTC 2019 on sn-devel-184
2019-11-19 04:47:47 +00:00
Andrew Bartlett
d6fbfb276c lib/fuzzing: Free memory after successful load in fuzz_tiniparser
Otherwise we have a memory leak and so fail the Google oss-fuzz check_build test.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Mon Nov 18 21:02:52 UTC 2019 on sn-devel-184
2019-11-18 21:02:52 +00:00
Andrew Bartlett
43bc0b2c76 lib/fuzzing: Avoid NULL pointer de-ref from 0-length input
fmemopen() does not like 0-length input.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-11-18 19:39:30 +00:00
Uri Simchoni
4aea5c0972 tevent: Release tevent 0.10.2
* Upgrade waf to version 2.0.18 to fix a cross-compilation issue

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13846

Signed-off-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Uri Simchoni <uri@samba.org>
Autobuild-Date(master): Mon Nov 18 11:44:08 UTC 2019 on sn-devel-184
tevent-0.10.2
2019-11-18 11:44:08 +00:00
Uri Simchoni
28e4ac0e7a tdb: Release tdb 1.4.3
* Upgrade waf to version 2.0.18 to fix a cross-compilation issue.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13846

Signed-off-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
tdb-1.4.3
2019-11-18 10:11:41 +00:00
Uri Simchoni
3e2eafeb44 talloc: Release talloc 2.3.1
* Upgrade waf to 2.0.18 to fix a cross-compilation issue

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13846

Signed-off-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
talloc-2.3.1
2019-11-18 10:11:41 +00:00
Douglas Bagnall
e856877ef8 ndrdump: avoid use after free
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org>
Autobuild-Date(master): Sun Nov 17 23:54:11 UTC 2019 on sn-devel-184
2019-11-17 23:54:11 +00:00
Andrew Bartlett
816869ecea ndrdump: Use human-readable strings for NDR decode errors
These make much more sense than the NTSTATUS values they can be forced
to map to.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2019-11-17 22:28:41 +00:00
Andrew Bartlett
b3bdb17a35 selftest: Test fix for ndrdump of structures by number
This requires that misc.GUID not move in the IDL, so a comment is added.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14191

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2019-11-17 22:28:41 +00:00
Douglas Bagnall
2bb642d98e ndrdump: correctly find the public strict by number
We were finding a function that happened to have the same ordinal
number.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14191

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-11-17 22:28:41 +00:00
Andrew Bartlett
f1fa0d3b9d librpc: Use the fact that file_save() now uses O_EXCL in dcerpc_log_packet()
This avoids a race with file_exist() and demostrates a better
way to use this function.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Fri Nov 15 18:48:27 UTC 2019 on sn-devel-184
2019-11-15 18:48:27 +00:00
Andrew Bartlett
5e63e54f58 lib/util: change file_save_mode() to use O_EXCL
Almost all the callers are debug tools or developer debugging aids
and these callers clearly expect to create a new file.

Unchanged in behaviour is:
 - TLS certificate creation.  This already confirms the files do no exist
   prior to generation.

These will now no longer overwrite the given filename
 - net ads pac save
 - net eventlog export

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2019-11-15 17:21:32 +00:00
Björn Baumbach
55b2cb47a9 s3-build: add missing gnutls dependency
Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Andreas Schneider <asn@samba.org>
2019-11-15 17:21:32 +00:00
Andreas Schneider
8e8313b2b5 third_party: Update nss_wrapper to version 1.1.7
This adds missing support for Address Sanitzer.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Nov 14 23:50:06 UTC 2019 on sn-devel-184
2019-11-14 23:50:06 +00:00
Volker Lendecke
4320196977 lib: Fix an error path memleak in schannel_get_creds_state()
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-11-14 22:26:30 +00:00
Volker Lendecke
b1143a0c7e vfs: Use dbwrap_delete() in acl_tdb_delete()
Use the wrapper function that's already available for exactly this
purpose.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-11-14 22:26:30 +00:00
Volker Lendecke
0c2a706a11 vfs: Use dbwrap_store() in store_acl_blob_fsp()
Use the wrapper function that's already available for exactly this
purpose.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-11-14 22:26:30 +00:00
Volker Lendecke
5852bb9658 vfs: Use direct struct assignment in store_acl_blob_fsp()
2 lines less code

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-11-14 22:26:30 +00:00
Andrew Bartlett
f38077ea5e pidl: Handle obtaining objects from a fixed-size array
Previously we would assume the array head was the talloc context
however this is not the case if the array is a fixed size inline array
within the parent struct.

In that case the overall object's talloc context is the correct
context to reference.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Pair-programmed-with: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Noel Power <npower@samba.org>

Autobuild-User(master): Noel Power <npower@samba.org>
Autobuild-Date(master): Thu Nov 14 17:36:49 UTC 2019 on sn-devel-184
2019-11-14 17:36:49 +00:00
Douglas Bagnall
1261894eca pidl/python: allocate objects with ref pointers
Struct members that are marked as ref pointers need to have an object
allocated for them.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Pair-programmed-with: Andrew Bartlett <abartlet@samba.org>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Noel Power <npower@samba.org>
2019-11-14 16:12:40 +00:00
Douglas Bagnall
7e19779b66 pytests/segfault: pidl inline arrays
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Noel Power <npower@samba.org>
2019-11-14 16:12:40 +00:00
Douglas Bagnall
272e20adbb pytests/segfaults: dcerpc ref elements segfault
These are just a couple of examples.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Noel Power <npower@samba.org>
2019-11-14 16:12:40 +00:00
Douglas Bagnall
4dd725b1b5 pytests: rpc echo should not segfault
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Noel Power <npower@samba.org>
2019-11-14 16:12:40 +00:00
Douglas Bagnall
220cf67776 s4/rpc/dcerpc_connect: no crash on NULL dest_host
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Noel Power <npower@samba.org>
2019-11-14 16:12:40 +00:00
Amitay Isaacs
963a639101 ctdb-tests: Add tests for cmdline_add() api
Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>

Autobuild-User(master): Martin Schwenke <martins@samba.org>
Autobuild-Date(master): Thu Nov 14 12:03:46 UTC 2019 on sn-devel-184
2019-11-14 12:03:46 +00:00
Amitay Isaacs
e469d6c119 ctdb-common: Add api to add new section/commands to cmdline
Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
2019-11-14 10:38:34 +00:00
Amitay Isaacs
977a6f7fad ctdb-common: Change cmdline implementation to support multiple sections
Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
2019-11-14 10:38:34 +00:00
Amitay Isaacs
7a008c6b74 ctdb-tests: Update cmdline tests for section name
Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
2019-11-14 10:38:34 +00:00
Amitay Isaacs
b2b24c91fa ctdb-common: Add section to group commands in cmdline
Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
2019-11-14 10:38:34 +00:00
Amitay Isaacs
29948d7b1e ctdb-common: Generate usage message from cmdline_parse()
If any of the option parsing or command parsing fails, generate usage
message.

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
2019-11-14 10:38:34 +00:00