1
0
mirror of https://github.com/samba-team/samba.git synced 2025-01-06 13:18:07 +03:00
Commit Graph

5885 Commits

Author SHA1 Message Date
Björn Baumbach
22af043d2f CVE-2013-4476: s4:libtls: check for safe permissions of tls private key file (key.pem)
If the tls key is not owned by root or has not mode 0600 samba will not
start up.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10234

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Björn Baumbach <bb@sernet.de>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(master): Mon Nov 11 13:07:16 CET 2013 on sn-devel-104
2013-11-11 13:07:16 +01:00
Björn Baumbach
e0248cde8d CVE-2013-4476: s4:libtls: Create tls private key file (key.pem) with mode 0600
Bug: https://bugzilla.samba.org/show_bug.cgi?id=10234

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2013-11-11 11:14:36 +01:00
Andrew Bartlett
b2b948a1d0 lib/messaging: Check the server_id type correctly
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Thu Sep 19 23:19:16 CEST 2013 on sn-devel-104
2013-09-19 23:19:15 +02:00
Volker Lendecke
2055ce1dbe registry4: Fix CID 1034911 Dereference before null check
curbegin is always != NULL here (curend + 1) and is dereferenced by
strchr.

Signed-off-by: Volker Lendecke <vl@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-08-19 11:15:20 +12:00
Volker Lendecke
f82daa054a registry4: Fix CID 1034911 Dereference before null check
curbegin is always != NULL here (curend + 1) and is dereferenced by
strchr.

Signed-off-by: Volker Lendecke <vl@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-08-19 11:08:15 +12:00
Stefan Metzmacher
077dfd0a89 s4-lib/socket: Allocate a the larger sockaddr_un and not just a sockaddr_in in unixdom_get_my_addr()
This caused crashes in _tsocket_address_bsd_from_sockaddr() when we
read past the end of the allocation.

(similar to commit e9ae36e968)

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10042

Signed-off-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Jul 24 14:37:43 CEST 2013 on sn-devel-104
2013-07-24 14:37:43 +02:00
Andrew Bartlett
e9ae36e968 s4-lib/socket: Allocate a the larger sockaddr_un and not just a sockaddr_in in unixdom_get_peer_addr()
This caused crashes in _tsocket_address_bsd_from_sockaddr() when we
read past the end of the allocation.

Andrew Bartlett

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2013-07-23 15:35:08 -07:00
Andreas Schneider
7a50f089e0 s4-libregistry: Improve NULL handling of name.
Reviewed-by: David Disseldorp <ddiss@samba.org>
2013-03-05 23:30:11 +01:00
Andreas Schneider
cab969d5ec s4-libregistry: Fix path check and improve while loops.
Reviewed-by: David Disseldorp <ddiss@samba.org>
2013-03-05 23:30:03 +01:00
Andreas Schneider
2aca90b9a0 s4-libregistry: Make sure we don't dereference a NULL pointer.
Reviewed-by: David Disseldorp <ddiss@samba.org>
2013-03-05 23:30:01 +01:00
Andrew Bartlett
50b42d1c5b s4-lib/socket: Return the original EMSGSIZE when sendto() and setsockopt() both fail
This ensures that should we be unable to increase the socket size, we return an
error that the application layer above might expect and be able to make
as reasonable response to (such as switching to a stream-based transport).

This fixes up c692bb02b0.

As suggested by metze in https://bugzilla.samba.org/show_bug.cgi?id=9697#c4

Andrew Bartlett

Reviewed-by: Stefan Metzmacher <metze@samba.org>
2013-03-04 08:38:23 +01:00
Landon Fuller
c692bb02b0 Handle EMSGSIZE on UNIX domain sockets.
On some systems (eg, FreeBSD) the default SO_SNDBUF for UNIX
domain sockets is to small, and EMSGSIZE is returned. Other
systems provide a larger default send buffer, but there is
still no guarantee that the buffer will be sized appropriately.

This patch modifies the sendto() path to attempt to resize
the SO_SNDBUF dynamically upon an EMSGSIZE failure, and then
retry the send.

This fixes local DCE/RPC errors on FreeBSD, eg:

https://lists.samba.org/archive/samba-technical/2013-January/089881.html

Signed-Off-By: Landon Fuller <landonf@bikemonkey.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Sat Mar  2 23:34:03 CET 2013 on sn-devel-104
2013-03-02 23:34:03 +01:00
Jelmer Vernooij
87afc3aee1 Move python modules from source4/scripting/python/ to python/.
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Sat Mar  2 03:57:34 CET 2013 on sn-devel-104
2013-03-02 03:57:34 +01:00
Stefan Metzmacher
1b75475ade s4:lib/events: make use of samba_tevent_set_debug()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2013-02-28 12:12:36 +01:00
Stefan Metzmacher
8ec4d9cb00 s4:pyregistry: make use of samba_tevent_context_init()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2013-02-28 12:07:31 +01:00
Andreas Schneider
6213606771 s4-lib: Don't leak plugin handle on error.
Reviewed-by: Alexander Bokovoy <ab@samba.org>
2013-02-22 16:36:14 +01:00
Andreas Schneider
aa6cc31ef9 s4-policy: Fix memory leaks in push_recursive().
Reviewed-by: Alexander Bokovoy <ab@samba.org>
2013-02-22 16:36:14 +01:00
Andreas Schneider
f4d1e8c1e2 s4-registry: Don't leak file descriptor.
Reviewed-by: Alexander Bokovoy <ab@samba.org>
2013-02-22 16:36:14 +01:00
Andreas Schneider
66ee744ccb s4-registry: Don't leak memory on error.
Reviewed-by: Alexander Bokovoy <ab@samba.org>
2013-02-22 16:36:14 +01:00
Stefan Metzmacher
7fb720502f s4:lib/com: make use of samba_tevent_context_init()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2013-02-19 23:47:45 +01:00
Andreas Schneider
9c81260499 waf: Make sure we link against samba-util.
libcmdline-credentials.so needs samba_getpass() from libsamba-util.so,
so we need to link against it.

Reviewed-by: Andrew Bartlet <abartlet@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Thu Feb 14 16:56:29 CET 2013 on sn-devel-104
2013-02-14 16:56:29 +01:00
Andrew Bartlett
a321dd3aaf pymessaging: Pass around the server_id struct to python callbacks rather than the tuple
This is not used currently, but may avoid going to and from the python types when we do not need to.

Andrew Bartlett

Reviewed-by: Stefan Metzmacher <metze@samba.org>
2013-01-26 14:19:57 +01:00
Andrew Bartlett
a3054323d3 pymessaging: Use correct unsigned types for server ID tuple elememnts
This is needed if we start using the top bits of these values.

Andrew Bartlett

Reviewed-by: Matthieu Patou <mat@matws.net>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2013-01-26 13:47:35 +01:00
Andreas Schneider
1aa0503401 Use the new directory_create_or_exist_strict() function.
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-09 09:11:20 +01:00
Stefan Metzmacher
8d9a77f864 s4:lib/messaging: terminate the irpc_servers_byname() result with server_id_set_disconnected() (bug #9540)
Signed-off-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-09 09:11:20 +01:00
Andreas Schneider
ae6947cc48 s4-regsitry: Check return value of ldb_msg_add_empty().
Found by Coverity.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
2012-12-21 13:55:59 +01:00
Andreas Schneider
e136b95af8 s4-lib: Use directory_create_or_exist() to create messaging dir.
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
2012-12-21 13:55:59 +01:00
Andreas Schneider
7dd13503c0 s4-socket: Make sure unix socket addresses are null terminated.
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
2012-12-12 15:00:02 +01:00
Andreas Schneider
7cc108c93c cmdline: Use new samba_getpass() function.
Reviewed-by: Jelmer Vernooij <jelmer@samba.org>
2012-12-03 14:35:10 +01:00
Karolin Seeger
c86707973d docs: man regtree: Add missing meta data.
This avoids warnings during the waf build and removes "FIXME" entries from the
manpage.

Karolin

Reviewed-by: Andreas Schneider <asn@samba.org>
2012-11-29 13:42:09 +01:00
Karolin Seeger
53b9e4ba6b docs: man regshell: Add missing meta data.
This avoids warnings during the waf build and removes "FIXME" entries from the
manpage.

Karolin

Reviewed-by: Andreas Schneider <asn@samba.org>
2012-11-29 13:42:05 +01:00
Karolin Seeger
9678fca3c6 docs: man regpatch: Add missing meta data.
This avoids warnings during the waf build and removes "FIXME" entries from the
manpage.

Karolin

Reviewed-by: Andreas Schneider <asn@samba.org>
2012-11-29 13:42:00 +01:00
Karolin Seeger
1ad091296d docs: man regdiff: Add missing meta data.
This avoids warnings during the waf build and removes "FIXME" entries from the
manpage.

Karolin

Reviewed-by: Andreas Schneider <asn@samba.org>
2012-11-29 13:41:57 +01:00
Karolin Seeger
4ed7803c80 popt_common: Fix typos.
Karolin

Signed-off-by: Karolin Seeger <kseeger@samba.org>
Reviewed by: Jelmer Vernooij <jelmer@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Nov 15 01:31:50 CET 2012 on sn-devel-104
2012-11-15 01:31:50 +01:00
Andrew Bartlett
a732f2a621 pymessaging: Add irpc_servers_byname() and irpc_all_servers()
This will allow python scripts to inspect the process list.

Andrew Bartlett
2012-10-31 08:13:56 +11:00
Andrew Bartlett
76b7348299 pymessaging: Use the server_id IDL structure rather than a tuple
This will make it easier to pass this structure in and out.  The tuple is still
accepted as input.

Andrew Bartlett
2012-10-31 08:13:56 +11:00
Andrew Bartlett
3b4ef03097 imessaging: Add irpc_all_servers() to list all available servers
This is implemented with a tdb_traverse_read(), and will allow a tool
to disover the name and server_id of all Samba processes, as each
process registers itself to recieve messages.

Andrew Bartlett
2012-10-31 08:13:56 +11:00
Andrew Bartlett
7e562cf3eb s4-events: Do not vasprintf() the tevent debug messages that will not be shown
This malloc() and free() actually shows up quite high on a call profile of
provision of the AD DC.

Andrew Bartlett
2012-08-09 20:14:22 +10:00
Stefan Metzmacher
a370792cbc s4:libcli/pyerrors: s/PyErr_WERROR_IS_ERR_RAISE/PyErr_WERROR_NOT_OK_RAISE/
metze
2012-08-06 15:50:16 +02:00
Andrew Bartlett
b181a0b96b lib/param: Remove use of lp{cfg,}_socket_address outside the NBT client and server
In these other cases, control of the sockets to bind to can be obtained using
"bind interfaces only = yes" and "interfaces = ".

Andrew Bartlett
2012-07-27 17:59:51 +10:00
Andrew Bartlett
d0d05f8474 s4-lib/tls: Try socket_send() multiple times to send partial packets
This works around an artificial limitation in socket_wrapper that breaks
some versions of GnuTLS when we return a short write.

Instead, keep pushing until the OS will not take it.

The correct solution will be to use tls_tstream, but the client code
for this is not yet tested and needs the ldap client layer changed
to use it.

Andrew Bartlett

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Jul 18 11:23:55 CEST 2012 on sn-devel-104
2012-07-18 11:23:55 +02:00
Michael Adam
bf650a1b59 s4:registry:regdiff: use existing talloc context for the event context
Autobuild-User(master): Michael Adam <obnox@samba.org>
Autobuild-Date(master): Fri Jul 13 02:51:44 CEST 2012 on sn-devel-104
2012-07-13 02:51:44 +02:00
Michael Adam
342ab97506 s4:registry:regdiff: add TALLOC_CTX * argument to open_backend() 2012-07-13 00:57:20 +02:00
Michael Adam
6ee16cefc9 s4:registry: add a TALLOC_CTX argument to reg_open_remote() 2012-07-13 00:57:19 +02:00
Michael Adam
acd3a6bb6c s4:registry:testsuite: fix use of non-existent word (existant) 2012-06-12 07:21:44 +02:00
Andrew Bartlett
1e28aa147f build: Add missing deps and make MESSAGING a private library
To remove finddcs_nbt these missing deps need to be added.  These
subsystems linked to to implicit dependencies provided by finddcs.
Due to the new arrangmenet of subsystems, MESSAGING needs to be a
private library to avoid being a source of duplicate symbols.

Andrew Bartlett
2012-06-07 06:45:06 +02:00
Stefan Metzmacher
bf8829b56f s4:lib/events: no longer define TEVENT_COMPAT_DEFINES
metze
2012-05-14 15:12:34 +02:00
Stefan Metzmacher
d41db7247f s4:lib/events: remove unused event_context_find() prototype
metze
2012-05-14 15:12:34 +02:00
Michael Adam
e75a9c1ad8 s4:lib: remove unused wscript_build file
This only contains a "GENCACHE" subsystem that is not
referenced anywhere.
2012-05-11 20:16:38 +02:00
Jelmer Vernooij
d3b4c2c771 UTIL_TDB: lowercase name.
Autobuild-User: Jelmer Vernooij <jelmer@samba.org>
Autobuild-Date: Thu May  3 20:18:22 CEST 2012 on sn-devel-104
2012-05-03 20:18:22 +02:00