1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-22 13:34:15 +03:00
Commit Graph

945 Commits

Author SHA1 Message Date
Matthew DeVore
232054c09b lib/util: remove extra safe_string.h file
lib/util/safe_string.h is similar to source3/include/safe_string.h, but
the former has fewer checks. It is missing bcopy, strcasecmp, and
strncasecmp.

Add the missing elements to lib/util/safe_string.h remove the other
safe_string.h which is in the source3-specific path. To accomodate
existing uses of str(n?)casecmp, add #undef lines to source files where
they are used.

Signed-off-by: Matthew DeVore <matvore@google.com>
Reviewed-by: David Mulder <dmulder@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Fri Aug 28 02:18:40 UTC 2020 on sn-devel-184
2020-08-28 02:18:40 +00:00
Mathieu Parent
9d935795ea Fix FTBFS / Increase the over-estimation for sparse files
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14418
Signed-off-by: Mathieu Parent <math.parent@gmail.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Tue Aug 25 04:23:19 UTC 2020 on sn-devel-184
2020-08-25 04:23:19 +00:00
Douglas Bagnall
2aace18f17 ldb_controls: control_to_string avoids crash
Otherwise a malformed control with unexpected NULL data will segfault
ldb_control_to_string(), though this is not very likely to affect
anyone in practice as converting controls to strings is rarely
necessary. If it happens at all in Samba it is in Python code.

Found by Honggfuzz using fuzz_ldb_parse_control.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org>
Autobuild-Date(master): Wed Jul 29 04:43:23 UTC 2020 on sn-devel-184
2020-07-29 04:43:23 +00:00
Volker Lendecke
9f3d2ba7ee ldb_ldap: Fix a memleak
Don't allocate a temporary value on a long-term context

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: David Mulder <dmulder@samba.org>
2020-07-02 10:38:34 +00:00
Gary Lockyer
d8b9bb274b CVE-2020-10730: lib ldb: Check if ldb_lock_backend_callback called twice
Prevent use after free issues if ldb_lock_backend_callback is called
twice, usually due to ldb_module_done being called twice. This can happen if a
module ignores the return value from function a function that calls
ldb_module_done as part of it's error handling.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14364

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-07-02 09:01:41 +00:00
Alexander Bokovoy
990a0fc4a0 ldb_ldap: fix off-by-one increment in lldb_add_msg_attr
Fix regression introduced by commit ce2bf5c72b

lldb_add_msg_attr() calls ldb_msg_add_empty() which, in turn, calls
calls _ldb_msg_add_el() which already increments msg->num_elements by one.

As a result, msg->num_elements is bigger than the actual number of
elements and any iteration over elements would step over elements array
boundary.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14413
Signed-off-by: Alexander Bokovoy <ab@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Fri Jun 19 08:35:33 UTC 2020 on sn-devel-184
2020-06-19 08:35:33 +00:00
Alexander Bokovoy
36bd6edd8a lib/ldb: add unit test for ldb_ldap internal code
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14413
Signed-off-by: Alexander Bokovoy <ab@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2020-06-19 07:16:37 +00:00
Volker Lendecke
1cb17b5472 ldb: Avoid a cast (unsigned long long) in ldbmodify.c
We have %zu for size_t

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-06-15 17:59:39 +00:00
Douglas Bagnall
e73c89f155 ldb commandline: don't crash if a received control contains no data
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-06-13 05:25:31 +00:00
Douglas Bagnall
def6b65c42 ldb/controls: avoid stealing our own stuff
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-06-13 05:25:31 +00:00
Douglas Bagnall
3fb21ed12e ldb/mod/paged_searches: cope with NULL control data
We won't get NULL data over ldap, but it can be set via 'local_oid:'.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-06-13 05:25:31 +00:00
Björn Jacke
a4041ee6ca ldb: also use portable __has_attribute macro to check for attribute support
Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-05-24 23:55:36 +00:00
Gary Lockyer
a699256f43 lib ldb: Limit depth of ldb_parse_tree
Limit the number of nested conditionals allowed by ldb_parse tree to
128, to avoid potential stack overflow issues.

Credit Oss-Fuzz

REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19508

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Gary Lockyer <gary@samba.org>
Autobuild-Date(master): Sun May 10 23:21:08 UTC 2020 on sn-devel-184
2020-05-10 23:21:08 +00:00
Gary Lockyer
8c17b6f82f Fix clang 9 format-nonliteral warnings
Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>
2020-05-08 09:31:31 +00:00
Gary Lockyer
13a2f70a4d Fix clang 9 missing-field-initializer warnings
Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>
2020-05-08 09:31:31 +00:00
Gary Lockyer
9df4d6ab49 Fix clang 9 parentheses-equality warnings
Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>
2020-05-08 09:31:31 +00:00
Andrew Bartlett
c309e6b2a7 CVE-2020-10700: ldb: Always use ldb_next_request() in ASQ module
We want to keep going down the module stack, and not start from the top again.

ASQ is above the ACL modules, but below paged_results and we do not wish to
re-trigger that work.

Thanks to Andrei Popa <andrei.popa@next-gen.ro> for finding,
reporting and working with us to diagnose this issue!

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14331

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2020-05-04 08:19:41 +00:00
Gary Lockyer
d1f4002b91 lib ldb: lmdb init var before calling mdb_reader_check
Initilalise "stale" to zero before passing a pointer to it to
mdb_reader_check.

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Tue Apr  7 12:29:00 UTC 2020 on sn-devel-184
2020-04-07 12:29:00 +00:00
Gary Lockyer
89041a6d18 lib ldb: lmdb clear stale readers on write txn start
In use process failures and Bind9 shut downs leave stale entries in the
lmdb reader table.  This can result in lmdb filling it's database file, as
the free list can not be reclaimed due to the stale reader.

In this fix we call mdb_reader_check at the start of each transaction,
to free any stale readers.  As the default maximum number of readers is
127, this should not impact on performance to any great extent.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14330

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Tue Mar 31 01:26:07 UTC 2020 on sn-devel-184
2020-03-31 01:26:07 +00:00
Volker Lendecke
130502af0b ldb: Use ARRAY_DEL_ELEMENT() in ldb_dn_set_extended_component()
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-03-26 14:43:32 +00:00
Volker Lendecke
f2a4eecbb3 ldb: Use ARRAY_DEL_ELEMENT() in ldb_dn_extended_filter()
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-03-26 14:43:32 +00:00
Volker Lendecke
61a28bceef ldb: Use ARRAY_DEL_ELEMENT() in ldb_kv_index_del_value()
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-03-26 14:43:32 +00:00
Volker Lendecke
d45174a060 ldb: Use ARRAY_DEL_ELEMENT() in ldb_kv_msg_delete_element()
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-03-26 14:43:31 +00:00
Andrew Bartlett
5c1867ba45 py3: Remove #define PyInt_FromLong PyLong_FromLong
This allows us to end the use of Python 2/3 compatability macros.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Noel Power
2020-03-23 19:12:43 +00:00
Gary Lockyer
83ff052777 ldb build: Remove some PEP8 warnings from wscript
Fix indentation of list members and fix lines > 79 characters to remove
PEP8 warnings.

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-03-22 04:39:36 +00:00
Gary Lockyer
fc13304d15 ldb tests: Confirm lmdb free list handling
Add cmocka tests to confirm lmdb's handling of the free list.

As a result of lmdb's MVCC (Multiversion Concurrency Control) long
running read transactions or stale readers (read transactions where the
process exited without ending the transaction) can cause the database to
run out of space.

Items in the free list are only reused when they would not be visible in
a read transaction.  So long running read transactions prevent entries
in the free list being reused, and the database can run out of space.

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-03-22 04:39:36 +00:00
Andrew Bartlett
b8aa05525e ldb: ensure that ldbedit operates like ldbmodify: set DONT_CREATE_DB
ldb* tools, when passed a raw filename assume tdb://

By default, ldb_tdb will call tdb with O_CREAT.

TDB, when passed O_CREAT and a not-tdb file, will wipe the file.

This means that if you run ldbedit <path to mdb-format-ldb file> the file
will be wiped, which is unexpected.  I noticed this while trying to
corrupt a sam.ldb backend file (for testing), but instead I wiped it!

Ideally tdb would not do that, but the behaviour has been this way for
decades.  Ideally ldb would have had a "create db" command, but this
has been the job of ldbadd for over a decade.

So this just blunts the knife for ldbedit.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14302

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2020-03-02 02:47:30 +00:00
Andrew Bartlett
535debb312 ldb: Add mem_ctx argument to ldb_kv_index_key()
This avoids using "ldb" as the memory context in most cases, and may avoid
a long-term memory leak if future changes cause dn_key not to be freed.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14299

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2020-02-28 03:08:46 +00:00
Andrew Bartlett
48cfb8458b ldb: Improve coding style in ldb_kv_index_dn_simple()
We avoid bare if conditions in Samba.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14299

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2020-02-28 03:08:46 +00:00
Andrew Bartlett
0a87f59ac2 ldb: Fix memory leak in ldb_kv_index_dn_ordered()
We need to ensure we TALLOC_FREE(tmp_ctx) in every error exit.

Reported by Alex Kolesnik, ABISoft Ltd., www.abisoft.biz.  Thanks!

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14299

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2020-02-28 03:08:45 +00:00
Stefan Metzmacher
340cd2b816 ldb: change the version to 2.2.0 for Samba 4.13
Signed-off-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Wed Feb 26 23:11:39 UTC 2020 on sn-devel-184
2020-02-26 23:11:39 +00:00
Stefan Metzmacher
0ca46a3726 ldb: version 2.1.1
* Bug 14270:
  Samba 4.11 and later give incorrect results for SCOPE_ONE searches

Signed-off-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(master): Tue Feb 25 12:59:02 UTC 2020 on sn-devel-184
2020-02-25 12:59:02 +00:00
Andrew Bartlett
0b8ab02008 ldb: Add tests aimed at the SCOPE_ONELEVEL bug in particular
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14270

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2020-02-25 10:38:34 +00:00
Andrew Bartlett
3c7261c43d ldb: Fix search with scope ONE and small result sets
This changes the LDB behaviour in the combination of a SCOPE_ONE search and
an index returning less than 10 results.

After b6b5b5fe35 the list->strict flag
became set to false in all cases, rather than being left to the
value set by the caller.

This changes the ldb_kv_index_dn_one() code to force strict
mode on success instead.

Thanks to Marcus Granér, ICEYE Oy for reporting.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14270

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2020-02-25 10:38:34 +00:00
Andrew Bartlett
ec34a70957 ldb: Ensure @IDXONE modes is tested in ldb.python (apy.py) tests
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2020-02-25 10:38:34 +00:00
Andrew Bartlett
167676973b ldb: Add tests aimed at the SCOPE_ONELEVEL particular
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14270

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2020-02-25 10:38:34 +00:00
Andrew Bartlett
17bd63dbea ldb: Add tests for one-level indexes in conjunction with other indexes
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14270

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2020-02-25 10:38:34 +00:00
Gary Lockyer
79460b1b9f lib ldb common: Fix memory leak
TALLOC_FREE the ldb_control allocated in ldb_parse_control_from_string
when none of the cases match.

Credit to OSS-Fuzz

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: David Disseldorp <ddiss@samba.org>
2020-01-15 19:58:41 +00:00
Douglas Bagnall
16ca385013 ldb controls: fix typo in bypassoperational message
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-01-12 19:50:37 +00:00
Fabrice Fontaine
f8799bf076 lib/ldb/tests: include stdint.h before cmocka.h
This fix the following build failures:

[2466/3864] Linking bin/default/lib/ldb/ldbmodify
In file included from /home/buildroot/autobuild/instance-0/output-1/host/opt/ext-toolchain/lib/gcc/mips64el-buildroot-linux-uclibc/5.5.0/include/stdint.h:9:0,
                 from ../../lib/tevent/tevent.h:31,
                 from ../../lib/ldb/include/ldb.h:51,
                 from ../../lib/ldb/tests/test_ldb_dn.c:25:
/home/buildroot/autobuild/instance-0/output-1/host/mips64el-buildroot-linux-uclibc/sysroot/usr/include/stdint.h:122:27: error: conflicting types for 'uintptr_t'
 typedef unsigned long int uintptr_t;
                           ^
In file included from ../../lib/ldb/tests/test_ldb_dn.c:23:0:
/home/buildroot/autobuild/instance-0/output-1/host/mips64el-buildroot-linux-uclibc/sysroot/usr/include/cmocka.h:132:28: note: previous declaration of 'uintptr_t' was here
       typedef unsigned int uintptr_t;
                            ^

In file included from /home/buildroot/autobuild/instance-0/output-1/host/opt/ext-toolchain/lib/gcc/mips64el-buildroot-linux-uclibc/5.5.0/include/stdint.h:9:0,
                 from ../../lib/tevent/tevent.h:31,
                 from ../../lib/ldb/tests/ldb_key_value_test.c:48:
/home/buildroot/autobuild/instance-0/output-1/host/mips64el-buildroot-linux-uclibc/sysroot/usr/include/stdint.h:122:27: error: conflicting types for 'uintptr_t'
 typedef unsigned long int uintptr_t;
                           ^
In file included from ../../lib/ldb/tests/ldb_key_value_test.c:43:0:
/home/buildroot/autobuild/instance-0/output-1/host/mips64el-buildroot-linux-uclibc/sysroot/usr/include/cmocka.h:132:28: note: previous declaration of 'uintptr_t' was here
       typedef unsigned int uintptr_t;
                            ^

Fixes:
 - http://autobuild.buildroot.org/results/9507739b3d5d51024ee9c60b74c2f85d5004e7e2

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14218

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Reviewed-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2019-12-18 15:32:40 +00:00
Gary Lockyer
4d9753dfbd lib ldb: fix use after free
Fix ASAN detected use after free.  No security implications as  the
talloc_free is followed immediately by the print statement and the value
printed is an integer

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-12-18 06:39:26 +00:00
Andreas Schneider
e79e943824 ldb:tests: Add missing null check for ldb_kv_private
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Gary Lockyer <gary@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Fri Dec  6 11:13:24 UTC 2019 on sn-devel-184
2019-12-06 11:13:24 +00:00
Andreas Schneider
9323b5c500 ldb:tests: Add missing size check for tdb
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Gary Lockyer <gary@samba.org>
2019-12-06 09:12:26 +00:00
Andreas Schneider
e464e40c97 ldb:tests: Use assert_in_range() in test_get_size()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Gary Lockyer <gary@samba.org>
2019-12-06 09:12:26 +00:00
Andreas Schneider
9a1072ddb6 ldb: Avoid a possible NULL pointer dereference
Found by cppcheck.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Gary Lockyer <gary@samba.org>
2019-12-06 09:12:26 +00:00
Andreas Schneider
ea1c62f3c7 ldb:tests: Allow test filtering in ldb_mod_op_test
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Isaac Boukris <iboukris@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Thu Dec  5 17:13:36 UTC 2019 on sn-devel-184
2019-12-05 17:13:36 +00:00
Andreas Schneider
520bb70dfd ldb:tests: Avoid that the debug function overwrites memory
We are setting ldb_debug_string() as the ldb debug function. The context
we give it is only valid as long as we're in that function.

On failure, we jump to the teardown function. The pointer for
debug_string isn't valid anymore, but the ldb debug system still points
to that address, and when we store the location of the allocated string,
we overwrite memory, in that case something from talloc and a
talloc_free() then jumps into the nirvana.

Thanks to Florian Weimer who helped debugging this.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Isaac Boukris <iboukris@samba.org>
2019-12-05 15:35:37 +00:00
Andrew Bartlett
10058bcfa1 ldb: Extend the ldb_dn_explode test matrix
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14049

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2019-08-27 04:44:41 +00:00
Andrew Bartlett
a8a3cef3a7 ldb: Do not read beyond the end of the extended DN component when printing
The print functions used in Samba NULL terminate, but do not assume they will

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14049

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2019-08-27 04:44:41 +00:00
Andrew Bartlett
52bd2dde5a ldb: Add test with == true or false to boolean if statements in ldb_dn_explode()
This is beyond the normal level of clarity we expect in Samba, and is of course
rudundent, but this is a complex routine that has confusing tests, some of
pointers and some of boolean state values.

This tries to make the code as clear as possible pending a more comprehensive
rewrite.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14049

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2019-08-27 04:44:41 +00:00