1
0
mirror of https://github.com/samba-team/samba.git synced 2025-01-21 18:04:06 +03:00

36449 Commits

Author SHA1 Message Date
Andrew Bartlett
3657bbc211 dsdb: Correctly handle memory in objectclass_attrs
el->values is caller-provided memory that should be thought of as constant,
it should not be assumed to be a talloc context.

Otherwise, if the caller gives constant memory or a stack
pointer we will get an abort() in talloc when it expects
a talloc magic in the memory preceeding the el->values.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14258

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2020-02-06 14:57:42 +00:00
Andrew Bartlett
d3b385d596 source4/scripting/bin: Swap machine account password scripts
I regularly get requests for my simple script to print the
password from the secrets.tdb (or secrets.ldb on the AD DC).

This removes the old script that only reads the secrets.ldb.

Neither new nor old script has tests, however it seems
better to have it in the tree where it can be found rather
that me digging it out of my outbound e-mail.

Originally posted here:
 https://lists.samba.org/archive/samba/2017-November/212362.html

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2020-02-06 14:57:42 +00:00
Stefan Metzmacher
8b80145a2c s4:torture: make rpc.handles.random-assoc test even more robust
This improves commit bebee47e6386476e9948089484f89d213fcc2660 a bit
further.

I just got this:

  connect samr pipe1
  use assoc_group_id[0x00000001] for new connections
  connect lsa pipe2
  got assoc_group_id[0x00000001] for p2
  samr_Connect to open a policy handle on samr p1
  use policy handle on lsa p2 - should fail
  closing policy handle on samr p1
  connect samr pipe3 - should fail
  Failed to bind to uuid 12345778-1234-abcd-ef00-0123456789ac for ncacn_np:localdc[\pipe\samr,validate,assoc_group_id=0x00000001,abstract_syntax=12345778-1234-abcd-ef00-0123456789ac/0x00000001] NT_STATUS_UNSUCCESSFUL
  connect lsa pipe4 - should fail
  Failed to bind to uuid 12345778-1234-abcd-ef00-0123456789ab for ncacn_np:localdc[\pipe\lsarpc,validate,assoc_group_id=0x00000001,abstract_syntax=12345778-1234-abcd-ef00-0123456789ab/0x00000000] NT_STATUS_UNSUCCESSFUL
  connect samr pipe5 with assoc_group_id[0xFFFFFFFF]- should fail
  Failed to bind to uuid 12345778-1234-abcd-ef00-0123456789ac for ncacn_np:localdc[\pipe\samr,validate,assoc_group_id=0xffffffff,abstract_syntax=12345778-1234-abcd-ef00-0123456789ac/0x00000001] NT_STATUS_UNSUCCESSFUL
  connect lsa pipe6 with assoc_group_id[0x00000000]- should fail
  UNEXPECTED(failure): samba4.rpc.handles on ncacn_np with validate.mixed-shared(ad_dc_ntvfs)
  REASON: Exception: Exception: ../../source4/torture/rpc/handles.c:500: status was NT_STATUS_OK, expected NT_STATUS_UNSUCCESSFUL: opening lsa pipe6
  FAILED (1 failures, 0 errors and 0 unexpected successes in 0 testsuites)
  A summary with detailed information can be found in:

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2020-02-06 14:57:41 +00:00
Ralph Boehme
d1b2254f45 s4/auth: use talloc_alpha_strcpy() in auth_session_info_fill_unix()
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2020-02-06 10:17:43 +00:00
Stefan Metzmacher
6cbd7d1a32 s4:param: make sure secrets_db_connect() no longer creates on empty secrets.ldb
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Wed Feb  5 10:13:02 UTC 2020 on sn-devel-184
2020-02-05 10:13:02 +00:00
Stefan Metzmacher
0344b92b65 s4:param: make use of secrets_db_create() in provision_store_self_join()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2020-02-05 08:46:39 +00:00
Stefan Metzmacher
32f7562147 s4:param: add secrets_db_create() helper function
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2020-02-05 08:46:39 +00:00
Stefan Metzmacher
87ae154ef9 s4:rpc_server/lsa: remove some useless talloc_reference() calls
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2020-02-05 08:46:38 +00:00
Andreas Schneider
677bc1b184 s4:torture: Skip the deltest20 as user root
The test is meant to be run as a user and not root.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14257

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Thu Jan 30 16:54:33 UTC 2020 on sn-devel-184
2020-01-30 16:54:33 +00:00
David Mulder
1bb16ff4e2 s4:torture: Convert samba4.base.charset test to smb2
The partial surrogate test is known to fail (in
both smb1 and smb2).

Signed-off-by: David Mulder <dmulder@suse.com>
Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Ralph Böhme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Noel Power <npower@samba.org>
Autobuild-Date(master): Thu Jan 30 12:05:13 UTC 2020 on sn-devel-184
2020-01-30 12:05:13 +00:00
Björn Baumbach
2697415239 selftest: add test for samba-tool groupmember --member-base-dn option
Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-01-21 14:38:47 +00:00
Björn Baumbach
8c5a266ef3 selftest: add tests for samba-tool group addmembers --object-types option
Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-01-21 14:38:47 +00:00
Björn Baumbach
347c65434e selftest: add test for new samba-tool group addmembers --member-dn option
Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-01-21 14:38:47 +00:00
Björn Baumbach
b545ab1a85 samba-tool tests: add test-case for 'user getgrouops --full-dn'
Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-01-21 14:38:45 +00:00
Gary Lockyer
13658324a3 CVE-2019-19344 kcc dns scavenging: Fix use after free in dns_tombstone_records_zone
ldb_msg_add_empty reallocates the underlying element array, leaving
old_el pointing to freed memory.

This patch takes two defensive copies of the ldb message, and performs
the updates on them rather than the ldb messages in the result.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=14050

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>

Autobuild-User(master): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(master): Tue Jan 21 11:38:38 UTC 2020 on sn-devel-184
2020-01-21 11:38:38 +00:00
Andrew Bartlett
86023642c3 repl_meta_data: Only reset replMetaData entry for name if we made a conflict name here
We previously set it for any rename

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2020-01-21 10:11:39 +00:00
Andrew Bartlett
9e126852a6 repl_meta_data: Do not set *rename = true unless there has been a conflict on the incoming DN
The normal case of a partner-sent rename is not a cause for updating the replPropertyMetaData

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2020-01-21 10:11:39 +00:00
Andrew Bartlett
512ea17983 repl_meta_data: Add comment explaining what is being renamed after the conflict is resolved
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2020-01-21 10:11:39 +00:00
Andrew Bartlett
2b1828276b CVE-2019-14902 dsdb: Change basis of descriptor module deferred processing to be GUIDs
We can not process on the basis of a DN, as the DN may have changed in a rename,
not only that this module can see, but also from repl_meta_data below.

Therefore remove all the complex tree-based change processing, leaving only
a tree-based sort of the possible objects to be changed, and a single
stopped_dn variable containing the DN to stop processing below (after
a no-op change).

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12497

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2020-01-21 10:11:38 +00:00
Andrew Bartlett
b7030f9a8b CVE-2019-14902 repl_meta_data: Set renamed = true (and so do SD inheritance) after any rename
Previously if there was a conflict, but the incoming object would still
win, this was not marked as a rename, and so inheritence was not done.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12497

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2020-01-21 10:11:38 +00:00
Andrew Bartlett
4c62210098 CVE-2019-14902 repl_meta_data: Fix issue where inherited Security Descriptors were not replicated.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12497

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2020-01-21 10:11:38 +00:00
Andrew Bartlett
520d2ae187 CVE-2019-14902 repl_meta_data: schedule SD propagation to a renamed DN
We need to check the SD of the parent if we rename, it is not the same as an incoming SD change.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12497

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2020-01-21 10:11:38 +00:00
Andrew Bartlett
3f3791765c CVE-2019-14902 dsdb: Ensure we honour both change->force_self and change->force_children
If we are renaming a DN we can be in a situation where we need to

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12497

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2020-01-21 10:11:38 +00:00
Andrew Bartlett
5d714c1cea CVE-2019-14902 dsdb: Add comments explaining why SD propagation needs to be done here
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12497

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2020-01-21 10:11:38 +00:00
Andrew Bartlett
545d205e5b CVE-2019-14902 dsdb: Explain that descriptor_sd_propagation_recursive() is proctected by a transaction
This means we can trust the DB did not change between the two search
requests.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12497

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2020-01-21 10:11:38 +00:00
Andrew Bartlett
febe15ab2e selftest: Add test to confirm ACL inheritence really happens
While we have a seperate test (sec_descriptor.py) that confirms inheritance in
general we want to lock in these specific patterns as this test covers
rename.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2020-01-21 10:11:38 +00:00
Andrew Bartlett
d64670bab8 CVE-2019-14902 selftest: Add test for a special case around replicated renames
It appears Samba is currently string-name based in the ACL inheritence code.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12497

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2020-01-21 10:11:38 +00:00
Andrew Bartlett
7b19e221ae CVE-2019-14902 selftest: Add test for replication of inherited security descriptors
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12497

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2020-01-21 10:11:38 +00:00
Volker Lendecke
b274bc698e dsdb: Use write_data() to write to the password check script
A simple write() might be interrupted or do short writes. Highly
unlikely, but if it happens, it will be impossible to diagnose.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-01-19 18:29:39 +00:00
Volker Lendecke
229518ec01 dsdb: Align integer types
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-01-19 18:29:39 +00:00
Andrew Bartlett
cffcc39f18 heimdal_build: Remove bashism from --address-sanitizer build rule
export FOO=bar is a Bash extension, and is not required in this case, we only need the asn1_compile
to run under the variable, there are no further commands in this sub-shell.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Isaac Boukris <iboukris@samba.org>

Autobuild-User(master): Isaac Boukris <iboukris@samba.org>
Autobuild-Date(master): Sat Jan 18 12:25:16 UTC 2020 on sn-devel-184
2020-01-18 12:25:16 +00:00
Günther Deschner
ac5b742702 s4-torture: increase various bufsizes to better deal with Windows 2019 clusters
Guenther

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-01-16 20:09:42 +00:00
Günther Deschner
83bbc5cc42 s4-torture: fix copy/paste error in clusapi group test
Guenther

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-01-16 20:09:42 +00:00
Günther Deschner
edf21f5e30 s4-torture: add clusapi GroupSet tests
Guenther

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-01-16 20:09:42 +00:00
Günther Deschner
21157c66ab s4-torture: fix asserts in clusapi_NodeControl tests
Guenther

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-01-16 20:09:42 +00:00
Günther Deschner
efe353edf4 s4-torture: save cluster version in clusapi test context
Guenther

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-01-16 20:09:42 +00:00
Björn Baumbach
6b8a683884 tests: Test samba-tool user setprimarygroup command
Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Wed Jan 15 13:30:53 UTC 2020 on sn-devel-184
2020-01-15 13:30:53 +00:00
Björn Baumbach
fd1c905ec3 tests: Test samba-tool user getgroups command
Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Andreas Schneider <asn@samba.org>
2020-01-15 12:05:33 +00:00
Björn Baumbach
d73a9d1a8d selftest: create working directory for blackbox test
Required to run test separately.

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Andreas Schneider <asn@samba.org>
2020-01-15 12:05:33 +00:00
Günther Deschner
c433dac598 librpc: pidlify spoolss_EnumPerMachineConnections
Guenther

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-01-08 23:51:31 +00:00
Günther Deschner
210a8f35b6 s4-torture: add test for spoolss_EnumPerMachineConnections
Guenther

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-01-08 23:51:30 +00:00
Günther Deschner
0a76a7c3c2 s4-torture: add test for spoolss AddPerMachineConnection
Guenther

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-01-08 23:51:30 +00:00
Günther Deschner
e17c8e1b40 librpc: fix IDL for spoolss_GetCorePrinterDrivers()
The charset determination makes it more difficult to deal with the real
REG_MULTI_SZ nature of that element.

Guenther

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-01-08 23:51:30 +00:00
Volker Lendecke
fd406528b7 dsdb: Align integer types
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>
2020-01-03 00:04:43 +00:00
Volker Lendecke
f53c8fbd7f audit_log: Align integer types
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>
2020-01-03 00:04:43 +00:00
Stefan Metzmacher
df5040b186 Happy New Year 2020!
Signed-off-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Wed Jan  1 12:04:52 UTC 2020 on sn-devel-184
2020-01-01 12:04:52 +00:00
David Mulder
33212832b0 Convert samba4.base.rw1 test to smb2
Signed-off-by: David Mulder <dmulder@suse.com>
Reviewed-by: Ralph Böhme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-12-20 22:01:28 +00:00
David Mulder
946beafb62 Convert samba4.base.*attr tests to smb2
Signed-off-by: David Mulder <dmulder@suse.com>
Reviewed-by: Ralph Böhme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-12-20 22:01:28 +00:00
Andrew Bartlett
16557e4480 selftest: Confirm parse of dnsProperty records
This confirms a name of "." will round-trip correctly.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2019-12-20 10:09:34 +00:00
Andrew Bartlett
30cbc5b90e s4-smbd: Also restart prefork children lost to SIGKILL (-9)
Samba 4.10 and later versions have a process restart capability to greatly
reduce the impact of crashes due to a NULL pointer de-reference or abort().

However SIGKILL was deliberatly omitted.

Sadly this is the most likely case, due to the OOM killer, as raised here:

https://lists.samba.org/archive/samba-technical/2019-November/134529.html

Subsequent discussion (offline) has been to agree that we should restart in
this case.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14221

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2019-12-20 10:09:34 +00:00