1
0
mirror of https://github.com/samba-team/samba.git synced 2025-01-12 09:18:10 +03:00
Commit Graph

123256 Commits

Author SHA1 Message Date
Noel Power
b95eea6b29 s3: libsmb: Cleanup - ensure we initialize all stack variables to 'safe' values when calling resolve_name_list()
Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-09-07 13:23:39 +00:00
Jeremy Allison
13acac25cb s3: libsmb: Cleanup - ensure we initialize all stack variables to 'safe' values when calling get_sorted_dc_list() that may not touch returns on error.
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Noel Power <npower@samba.org>
2020-09-07 13:23:39 +00:00
Jeremy Allison
c4c00d626c s3: libsmb: Cleanup - ensure we initialize all stack variables to 'safe' values when calling get_kdc_list() that may not touch returns on error.
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Noel Power <npower@samba.org>
2020-09-07 13:23:39 +00:00
Jeremy Allison
f11dce99cc s3: libsmb: discover_dc_netbios(). Remember to free on error return.
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Noel Power <npower@samba.org>
2020-09-07 13:23:39 +00:00
Andreas Schneider
0b742ec6a0 s4:smb_server: Use cli_credentials_init_server() for negprot
Signed-off-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Mon Sep  7 13:22:26 UTC 2020 on sn-devel-184
2020-09-07 13:22:26 +00:00
Andreas Schneider
6c94ebf77f s4:rpc_server: Use cli_credentials_init_server()
Signed-off-by: Andreas Schneider <asn@samba.org>
2020-09-07 12:02:15 +00:00
Andreas Schneider
2c00bea2ae auth:creds: Add cli_credentials_init_server()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2020-09-07 12:02:15 +00:00
Stefan Metzmacher
515cffb1f2 auth:gensec: If Kerberos is required, keep schannel for machine account auth
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Andreas Schneider <asn@samba.org>
2020-09-07 12:02:15 +00:00
Stefan Metzmacher
a33a40bbc8 auth:gensec: Pass use_kerberos and keep_schannel to gensec_use_kerberos_mechs()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2020-09-07 12:02:15 +00:00
Stefan Metzmacher
2186d4131a auth:gensec: Make gensec_use_kerberos_mechs() a static function
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2020-09-07 12:02:15 +00:00
Stefan Metzmacher
5e3363e0b8 s4:ldap_server: Use samba_server_gensec_start() in ldapsrv_backend_Init()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2020-09-07 12:02:15 +00:00
Stefan Metzmacher
b34e8dc898 auth:gensec: Add gensec_security_sasl_names()
Pair-Programmed-With: Andreas Schneider <asn@samba.org>

Signed-off-by: Andreas Schneider <asn@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2020-09-07 12:02:15 +00:00
David Mulder
5fc3a71d0f waf: upgrade to 2.0.20
This contain an important change:
"Fix gccdeps.scan() returning nodes that no longer exist on disk."
https://gitlab.com/ita1024/waf/-/merge_requests/2293

Signed-off-by: David Mulder <dmulder@suse.com>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2020-09-07 12:02:15 +00:00
Stefan Metzmacher
896b7bbcf2 bootstrap: install perl-JSON on on rpm distributions
This will be needed for the next heimdal import.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-09-07 12:02:15 +00:00
Stefan Metzmacher
e0e51632cf bootstrap: document git push -o ci.variable='SAMBA_CI_REBUILD_IMAGES=yes'
This is much easier than going through the web interface.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-09-07 12:02:15 +00:00
Stefan Metzmacher
b716dbc976 python/tests/gpo: this should fix a Popen deadlock
It is inspired by commit 5dc773a5b0
   Author: Joe Guo <joeg@catalyst.net.nz>
   Date:   Fri Sep 15 16:13:26 2017 +1200

      python: use communicate to fix Popen deadlock

      `Popen.wait()` will deadlock when using stdout=PIPE and/or stderr=PIPE and the
      child process generates large output to a pipe such that it blocks waiting for
      the OS pipe buffer to accept more data. Use communicate() to avoid that.

      Signed-off-by: Joe Guo <joeg@catalyst.net.nz>
      Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
      Reviewed-by: Andrew Bartlett <abartlet@samba.org>

      Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
      Autobuild-Date(master): Thu Oct 19 09:27:16 CEST 2017 on sn-devel-144

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Noel Power <noel.power@suse.com>
2020-09-07 12:02:15 +00:00
Andreas Schneider
6444a74352 s3:libads: Also add a realm entry for the domain name
This is required if we try to authenticate as Administrator@DOMAIN so it
can find the KDC. This fixes 'net ads join' for ad_member_fips if we
require Kerberos auth.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14479

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Isaac Boukris <iboukris@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Mon Sep  7 09:25:33 UTC 2020 on sn-devel-184
2020-09-07 09:25:33 +00:00
Andreas Schneider
a530396728 s3:libads: Only add RC4 if weak crypto is allowed
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Isaac Boukris <iboukris@samba.org>
2020-09-07 08:03:38 +00:00
Andreas Schneider
9cf1aecd73 s3:libads: Remove DES legacy types for Kerberos
We already removed DES support for Kerberos in Samba 4.12.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Isaac Boukris <iboukris@samba.org>
2020-09-07 08:03:38 +00:00
Hezekiah
bd9f64d19d Fixed arrow keys typo to the computer move command utility
Signed-off-by: Hezekiah <hezekiahmaina3@gmail.com>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>

Autobuild-User(master): Alexander Bokovoy <ab@samba.org>
Autobuild-Date(master): Fri Sep  4 16:57:30 UTC 2020 on sn-devel-184
2020-09-04 16:57:30 +00:00
David Disseldorp
12fbd5dcb1 build: avoid some unnecessary list.extend() calls
Signed-off-by: David Disseldorp <ddiss@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>

Autobuild-User(master): David Disseldorp <ddiss@samba.org>
Autobuild-Date(master): Thu Sep  3 13:33:54 UTC 2020 on sn-devel-184
2020-09-03 13:33:54 +00:00
David Disseldorp
ff39211d43 build: avoid unnecessary TO_LIST() calls for static strings
Signed-off-by: David Disseldorp <ddiss@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2020-09-03 12:10:35 +00:00
David Disseldorp
b6805d5e0b build: toggle vfs_snapper using --with-shared-modules
7ae03a19b3 ("build: add configure option to control vfs_snapper build")
added new --enable-snapper and --disable-snapper configure parameters to
control whether the vfs_snapper module was built.
The new parameters conflicted with existing
--with-shared-modules=[!]vfs_snapper behaviour.

This change reinstates working --with-shared-modules=[!]vfs_snapper
functionality. vfs_snapper stays enabled by default, but only on Linux.
Linux systems lacking the dbus library and header files should
explicitly disable the module via --with-shared-modules=!vfs_snapper as
documented.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=14437

Signed-off-by: David Disseldorp <ddiss@samba.org>
Reviewed-by: Björn Jacke <bjacke@samba.org>

Autobuild-User(master): David Disseldorp <ddiss@samba.org>
Autobuild-Date(master): Wed Sep  2 16:24:50 UTC 2020 on sn-devel-184
2020-09-02 16:24:50 +00:00
Volker Lendecke
50d900b6f9 tests: Make sure that idmap_ad retrieves unix nss attributes
Make sure that unix_primary_group and unix_nss_info idmap_ad options
work. We have two domains here and test wbinfo -i for both domains, so
we also run the test without those options for the trusted domain.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Wed Sep  2 10:35:53 UTC 2020 on sn-devel-184
2020-09-02 10:35:53 +00:00
David Mulder
1ba15c459b GPO: Update the samba-gpupdate man page
Signed-off-by: David Mulder <dmulder@suse.com>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-09-02 09:11:30 +00:00
David Mulder
11f97148bb gpo: Pass necessary parameters to rsop
These parameters were missed by mistake when exts
were modified to be initialized within the rsop
command. Fixes an exception thrown when executing
samba-gpupdate --rsop:

Traceback (most recent call last):
  File "/usr/sbin/samba-gpupdate", line 99, in <module>
    rsop(lp, creds, gp_extensions, opts.target)
  File "/usr/lib64/python3.8/site-packages/samba/gpclass.py", line 512, in rsop
    ext = ext(logger, lp, creds, store)
NameError: name 'logger' is not defined

Signed-off-by: David Mulder <dmulder@suse.com>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2020-09-02 09:11:30 +00:00
David Mulder
dff01a5edf gpo: Test rsop function for success
Signed-off-by: David Mulder <dmulder@suse.com>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2020-09-02 09:11:30 +00:00
David Mulder
07ce480888 samba-tool: Create unix user with modified template homedir
Signed-off-by: David Mulder <dmulder@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-09-02 09:11:29 +00:00
David Mulder
38fcad60a8 samba-tool: Test creating unix user with modified template homedir
Signed-off-by: David Mulder <dmulder@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-09-02 09:11:29 +00:00
Douglas Bagnall
0c461f3bd5 lzxpress: avoid technically undefined shift
UBSAN:

  runtime error: left shift of 1 by 31 places cannot be represented in type 'int'

Credit to OSS-fuzz.

REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22283

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Mon Aug 31 22:31:13 UTC 2020 on sn-devel-184
2020-08-31 22:31:13 +00:00
Douglas Bagnall
9c3ff1b955 lib/util/asn1: avoid technically undefined shift
UBSAN says

 runtime error: left shift of 255 by 24 places cannot be represented in type 'int'

Credit to OSS-Fuzz.

REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22889

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2020-08-31 21:06:29 +00:00
Gary Lockyer
2e37d22499 Fix clang 9 format-nonliteral warning
Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Noel Power <noel.power@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-08-31 21:06:29 +00:00
Noel Power
e3079c5387 python/samba/tests/blackbox: Tests with nested DFS container
Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Mon Aug 31 19:09:24 UTC 2020 on sn-devel-184
2020-08-31 19:09:24 +00:00
Noel Power
5b04affc73 s3/utils: restore client share connection after call to sec_desc_parse
This normally isn't a problem *except* for when the share is a dfs root
(which results in cli_resolve_patch creating an incorrect path)

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-08-31 17:44:38 +00:00
Noel Power
28719f3edc s3/utils: If dfs path is an ordinary path then really just return it
In cli_resolve_path if the share was a root dfs share then any self
hosted dfs paths end up not being returned as is but being decorated
with fileserver and share. This file path is not suitable for
passing to cli_list so we adjust it here.

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-08-31 17:44:38 +00:00
Noel Power
7faab75b47 python/samba/tests/blackbox: python smbcacls '--propagate-inherit' test
Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-08-31 17:44:38 +00:00
Noel Power
c4707e1dd8 doc: describe smbcacls --propagate-inheritance expanding INHERITANCE section
Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-08-31 17:44:38 +00:00
David Disseldorp
8c581758f6 doc: describe smbcacls --propagate-inheritance
Signed-off-by: David Disseldorp <ddiss@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-08-31 17:44:38 +00:00
Noel Power
0248fdd09a add new '--propagate-inheritance' option for smbcacls
smbcacls now can take a '--propagate-inheritance' flag to indicate that the
add, delete, modify and set operations now support automatic propagation of
inheritable ACE(s)

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-08-31 17:44:38 +00:00
Noel Power
c681f5bfe3 python/samba/tests/blackbox: Preparatory change to support custom share
tearDown method doesn't handle local file deletion fallback if a share
other than 'tmp' is used

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-08-31 17:44:38 +00:00
Noel Power
8826d74ae8 python/samba/tests:blackbox: Fix local file delete test tree fallback
Wrong indentation ensures the fallback where we use file system removal
of test files if the test's tearDown method fails.

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-08-31 17:44:38 +00:00
Noel Power
05de29a4d0 python/samba/tests/blackbox: Fix undetected deltree fail
With msdfs root share smbclient deltree command can fail without
setting the errorcode (e.g. when do_list encounters an error it will
log a warning message and continue rather than error out fatally)

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-08-31 17:44:38 +00:00
Stefan Metzmacher
b02f1d676f s3:share_mode_lock: remove unused reproducer for bug #14428
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14428

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Mon Aug 31 13:34:17 UTC 2020 on sn-devel-184
2020-08-31 13:34:17 +00:00
Stefan Metzmacher
b5c0874fd5 s3:share_mode_lock: make sure share_mode_cleanup_disconnected() removes the record
This fixes one possible trigger for "PANIC: assert failed in get_lease_type()"
https://bugzilla.samba.org/show_bug.cgi?id=14428

This is no longer enough to remove the record:

   d->have_share_modes = false;
   d->modified = true;

Note that we can remove it completely from
share_mode_cleanup_disconnected() as
share_mode_forall_entries() already sets it
when there are no entries left.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14428

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2020-08-31 11:57:01 +00:00
Stefan Metzmacher
1aa1ac9708 s3:share_mode_lock: add missing 'goto done' in share_mode_cleanup_disconnected()
When cleanup_disconnected_lease() fails we should stop,
at least we do that if brl_cleanup_disconnected() fails.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14428

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2020-08-31 11:57:01 +00:00
Stefan Metzmacher
4d740ac208 s3:share_mode_lock: consistently debug share_mode_entry records
share_mode_entry_do(), share_mode_forall_entries() and
share_entry_forall() print the record before the callback is called
and when it was modified or deleted.

This makes it much easier to debug problems.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14428

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2020-08-31 11:57:01 +00:00
Stefan Metzmacher
deb2f782c9 s3:share_mode_lock: let share_mode_forall_entries/share_entry_forall evaluate e.stale first
It's not really clear why e.stale would be ignored if *modified is set
to true.

This matches the behavior of share_mode_entry_do()

This also makes sure we see the removed entry in level 10 logs again.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14428

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2020-08-31 11:57:01 +00:00
Stefan Metzmacher
444f2bedf7 s3:share_mode_lock: reproduce problem with stale disconnected share mode entries
This reproduces the origin of "PANIC: assert failed in get_lease_type()"
(https://bugzilla.samba.org/show_bug.cgi?id=14428).

share_mode_cleanup_disconnected() removes disconnected entries from
leases.tdb and brlock.tdb but not from locking.tdb.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14428

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2020-08-31 11:57:01 +00:00
Stefan Metzmacher
560fe7b38f s3:selftest: also run durable_v2_reconnect_delay_msec in samba3.blackbox.durable_v2_delay
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14428

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2020-08-31 11:57:01 +00:00
Matthew DeVore
232054c09b lib/util: remove extra safe_string.h file
lib/util/safe_string.h is similar to source3/include/safe_string.h, but
the former has fewer checks. It is missing bcopy, strcasecmp, and
strncasecmp.

Add the missing elements to lib/util/safe_string.h remove the other
safe_string.h which is in the source3-specific path. To accomodate
existing uses of str(n?)casecmp, add #undef lines to source files where
they are used.

Signed-off-by: Matthew DeVore <matvore@google.com>
Reviewed-by: David Mulder <dmulder@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Fri Aug 28 02:18:40 UTC 2020 on sn-devel-184
2020-08-28 02:18:40 +00:00