1
0
mirror of https://github.com/samba-team/samba.git synced 2025-01-06 13:18:07 +03:00
Commit Graph

120808 Commits

Author SHA1 Message Date
Jule Anger
8f68236dc4 samba-tool: add -b/--base-dn option to groups list command
With this option it's e.g. possible to list the groups of a
specify OU or groups which are located under a different specific
place in the AD.

Signed-off-by: Jule Anger <ja@sernet.de>
Pair-programmed-with: Björn Baumbach <bb@samba.org>
Reviewed-by: Björn Baumbach <bb@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-01-21 14:38:45 +00:00
Björn Baumbach
b545ab1a85 samba-tool tests: add test-case for 'user getgrouops --full-dn'
Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-01-21 14:38:45 +00:00
Björn Baumbach
41262d1d66 samba-tool: add --full-dn option for user getgroups command
Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-01-21 14:38:45 +00:00
Jule Anger
d2d345103b samba-tool tests: add test-case for 'group listmembers --full-dn'
Check if the group listmembers --full-dn command displays DN instead of the sAMAccountName.

Signed-off-by: Jule Anger <ja@sernet.de>
Reviewed-by: Björn Baumbach <bb@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-01-21 14:38:45 +00:00
Jule Anger
bb66b32254 samba-tool: add --full-dn option to group listmembers command
With this option the command lists the groupmembers distinguished names
instead of the sAMAccountName.

Signed-off-by: Jule Anger <ja@sernet.de>
Reviewed-by: Björn Baumbach <bb@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-01-21 14:38:44 +00:00
Jule Anger
08207f77f1 samba-tool tests: add test case for 'user list --full-dn'
Check if the --full-dn option displays DN instead of the sAMAccountName.

Signed-off-by: Jule Anger <ja@sernet.de>
Reviewed-by: Björn Baumbach <bb@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-01-21 14:38:44 +00:00
Jule Anger
3106096395 samba-tool: add --full-dn option to user list command
With this option the command lists the users distringuished names
instead of the sAMAccountNames.

Signed-off-by: Jule Anger <ja@sernet.de>
Reviewed-by: Björn Baumbach <bb@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-01-21 14:38:44 +00:00
Jule Anger
2e767e81be samba-tool tests: add test case for 'computer list --full-dn'
Check if the --full-dn option displays DN instead of the sAMAccountName.

Signed-off-by: Jule Anger <ja@sernet.de>
Reviewed-by: Björn Baumbach <bb@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-01-21 14:38:44 +00:00
Jule Anger
29326e3264 samba-tool: add --full-dn option to computer list command
With this option the command lists the computers distringuished names
instead of the sAMAccountNames.

Signed-off-by: Jule Anger <ja@sernet.de>
Reviewed-by: Björn Baumbach <bb@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-01-21 14:38:44 +00:00
Jule Anger
e64f7de31f samba-tool tests: Add test-case for 'group list --full-dn'
Check if the --full-dn option displays DN instead of the sAMAccountName.

Signed-off-by: Jule Anger <ja@sernet.de>
Reviewed-by: Björn Baumbach <bb@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-01-21 14:38:44 +00:00
Björn Baumbach
51d4c82f3c samba-tool: add --full-dn option to group list command
With this option the command lists the groups distringuished names
instead of the sAMAccountNames.

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-01-21 14:38:44 +00:00
David Disseldorp
b813ef6ae7 Revert "vfs_glusterfs: Return fake fd from pipe() during open"
This reverts commit c9adf47ac5.
The fake fd is no longer necessary, as vfs_glusterfs now provides a
fcntl_fn hook.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14241

Signed-off-by: David Disseldorp <ddiss@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
2020-01-21 14:38:44 +00:00
David Disseldorp
cc4a55d290 vfs_glusterfs: add .fcntl_fn hook
This hook is currently called via vfs_set_blocking(), so can safely be
ignored.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14241

Signed-off-by: David Disseldorp <ddiss@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
2020-01-21 14:38:44 +00:00
David Disseldorp
b56c56eecd vfs_ceph: add .fcntl_fn hook
This hook is currently called via vfs_set_blocking(), so can safely be
ignored.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14241

Signed-off-by: David Disseldorp <ddiss@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
2020-01-21 14:38:44 +00:00
Volker Lendecke
0a77890bbc testenv: No "mktemp" for in_screen
We don't use this

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2020-01-21 14:38:44 +00:00
Volker Lendecke
823e4de309 testenv: Simplify "in_screen"
We don't need "seq", bash can do that itself, and we assume bash here

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2020-01-21 14:38:44 +00:00
Volker Lendecke
1ca1c60198 testenv: Properly kill daemons
Without this, all the daemons were kept around

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2020-01-21 14:38:43 +00:00
Volker Lendecke
4f1e4f9ce3 testenv: Be more careful deleting environment tmpfiles
If there is more than one server we will have for example nt4_dc.smbd,
nt4_dc.nmbd and nt4_dc.winbind as daemon environments, together with
the commandline environment "nt4_dc" coming last. Before this patch we
would have deleted all previous tmpfiles in the commandline environment.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2020-01-21 14:38:43 +00:00
Martin Schwenke
85478847a1 WHATSNEW: Add CTDB changes for 4.12
Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

Autobuild-User(master): Amitay Isaacs <amitay@samba.org>
Autobuild-Date(master): Tue Jan 21 13:05:00 UTC 2020 on sn-devel-184
2020-01-21 13:05:00 +00:00
Martin Schwenke
aa2977e151 ctdb-mutex: Change default re-check time for fcntl helper to 5s
Testing against a commonly used cluster filesystem has shown no
performance impact, as expected.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
2020-01-21 11:39:40 +00:00
Martin Schwenke
14b1dffc27 ctdb-tests: Add some tests to check recovery from recovery lock issues
Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
2020-01-21 11:39:40 +00:00
Martin Schwenke
64501f5193 ctdb-tests: Put recovery lock for local daemons into a subdirectory
This makes it more like the way it works with a cluster filesystem.
It also allows the subdirectory to be manipulated in tests.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
2020-01-21 11:39:40 +00:00
Martin Schwenke
93fc31858f ctdb-tests: Add local_daemons.sh option for recovery lock recheck interval
Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
2020-01-21 11:39:40 +00:00
Gary Lockyer
13658324a3 CVE-2019-19344 kcc dns scavenging: Fix use after free in dns_tombstone_records_zone
ldb_msg_add_empty reallocates the underlying element array, leaving
old_el pointing to freed memory.

This patch takes two defensive copies of the ldb message, and performs
the updates on them rather than the ldb messages in the result.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=14050

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>

Autobuild-User(master): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(master): Tue Jan 21 11:38:38 UTC 2020 on sn-devel-184
2020-01-21 11:38:38 +00:00
Andrew Bartlett
34a8cee348 CVE-2019-14907 lib/util: Do not print the failed to convert string into the logs
The string may be in another charset, or may be sensitive and
certainly may not be terminated.  It is not safe to just print.

Found by Robert Święcki using a fuzzer he wrote for smbd.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14208
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2020-01-21 10:11:39 +00:00
Andrew Bartlett
86023642c3 repl_meta_data: Only reset replMetaData entry for name if we made a conflict name here
We previously set it for any rename

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2020-01-21 10:11:39 +00:00
Andrew Bartlett
9e126852a6 repl_meta_data: Do not set *rename = true unless there has been a conflict on the incoming DN
The normal case of a partner-sent rename is not a cause for updating the replPropertyMetaData

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2020-01-21 10:11:39 +00:00
Andrew Bartlett
512ea17983 repl_meta_data: Add comment explaining what is being renamed after the conflict is resolved
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2020-01-21 10:11:39 +00:00
Andrew Bartlett
2b1828276b CVE-2019-14902 dsdb: Change basis of descriptor module deferred processing to be GUIDs
We can not process on the basis of a DN, as the DN may have changed in a rename,
not only that this module can see, but also from repl_meta_data below.

Therefore remove all the complex tree-based change processing, leaving only
a tree-based sort of the possible objects to be changed, and a single
stopped_dn variable containing the DN to stop processing below (after
a no-op change).

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12497

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2020-01-21 10:11:38 +00:00
Andrew Bartlett
b7030f9a8b CVE-2019-14902 repl_meta_data: Set renamed = true (and so do SD inheritance) after any rename
Previously if there was a conflict, but the incoming object would still
win, this was not marked as a rename, and so inheritence was not done.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12497

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2020-01-21 10:11:38 +00:00
Andrew Bartlett
4c62210098 CVE-2019-14902 repl_meta_data: Fix issue where inherited Security Descriptors were not replicated.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12497

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2020-01-21 10:11:38 +00:00
Andrew Bartlett
520d2ae187 CVE-2019-14902 repl_meta_data: schedule SD propagation to a renamed DN
We need to check the SD of the parent if we rename, it is not the same as an incoming SD change.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12497

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2020-01-21 10:11:38 +00:00
Andrew Bartlett
3f3791765c CVE-2019-14902 dsdb: Ensure we honour both change->force_self and change->force_children
If we are renaming a DN we can be in a situation where we need to

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12497

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2020-01-21 10:11:38 +00:00
Andrew Bartlett
5d714c1cea CVE-2019-14902 dsdb: Add comments explaining why SD propagation needs to be done here
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12497

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2020-01-21 10:11:38 +00:00
Andrew Bartlett
545d205e5b CVE-2019-14902 dsdb: Explain that descriptor_sd_propagation_recursive() is proctected by a transaction
This means we can trust the DB did not change between the two search
requests.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12497

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2020-01-21 10:11:38 +00:00
Andrew Bartlett
febe15ab2e selftest: Add test to confirm ACL inheritence really happens
While we have a seperate test (sec_descriptor.py) that confirms inheritance in
general we want to lock in these specific patterns as this test covers
rename.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2020-01-21 10:11:38 +00:00
Andrew Bartlett
d64670bab8 CVE-2019-14902 selftest: Add test for a special case around replicated renames
It appears Samba is currently string-name based in the ACL inheritence code.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12497

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2020-01-21 10:11:38 +00:00
Andrew Bartlett
7b19e221ae CVE-2019-14902 selftest: Add test for replication of inherited security descriptors
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12497

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2020-01-21 10:11:38 +00:00
Martin Schwenke
558bd7c83d util: Add detection of libunwind
The current detection doesn't seem to work, so libunwind doesn't seem
to be used.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Volker Lendecke <vl@samba.org>

Autobuild-User(master): Martin Schwenke <martins@samba.org>
Autobuild-Date(master): Tue Jan 21 08:12:17 UTC 2020 on sn-devel-184
2020-01-21 08:12:17 +00:00
Martin Schwenke
5ff83809a2 s3: lib: dbwrap_ctdb: Ensure value_valid is set when creating empty record
Fixes:

  PANIC: assert failed at ../../lib/dbwrap/dbwrap.c(82): rec->value_valid
  PANIC (pid 902392): assert failed: rec->value_valid
  BACKTRACE: 16 stack frames:
   #0 bin/shared/libsamba-util.so.0(log_stack_trace+0x30) [0x7fb161f69cb0]
   #1 bin/shared/libsmbconf.so.0(smb_panic_s3+0x23) [0x7fb1619f4863]
   #2 bin/shared/libsamba-util.so.0(smb_panic+0x2f) [0x7fb161f69daf]
   #3 bin/shared/private/libdbwrap-samba4.so(dbwrap_record_get_value+0x27) [0x7fb160a04c57]
   #4 bin/shared/libsamba-passdb.so.0(+0x2d27c) [0x7fb1618e627c]
   #5 bin/shared/libsamba-passdb.so.0(pdb_add_aliasmem+0x33) [0x7fb1618db663]
   #6 bin/shared/libsamba-passdb.so.0(+0x1edbb) [0x7fb1618d7dbb]
   #7 bin/shared/libsamba-passdb.so.0(create_builtin_administrators+0x167) [0x7fb1618d8217]
   #8 bin/shared/private/libauth-samba4.so(finalize_local_nt_token+0x39d) [0x7fb16194bd5d]
   #9 bin/shared/private/libauth-samba4.so(create_local_nt_token_from_info3+0x304) [0x7fb16194c3f4]
   #10 bin/shared/private/libauth-samba4.so(create_local_token+0x3d6) [0x7fb161945106]
   #11 bin/shared/private/libauth-samba4.so(+0x154b4) [0x7fb1619474b4]
   #12 bin/shared/private/libauth-samba4.so(init_guest_session_info+0x58) [0x7fb161947798]
   #13 ./bin/smbd(main+0x80f) [0x55944ef8f91f]
   #14 /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xeb) [0x7fb161076bbb]
   #15 ./bin/smbd(_start+0x2a) [0x55944ef90f8a]

This is a similar, additional fix to commit
36ea1e188d.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Mon Jan 20 04:25:57 UTC 2020 on sn-devel-184
2020-01-20 04:25:57 +00:00
Volker Lendecke
4dd026d0d3 smbd: Fix claiming version
We now have to do an explicit DOWNGRADE when we want to change from
G_LOCK_WRITE to G_LOCK_READ.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Sun Jan 19 19:58:01 UTC 2020 on sn-devel-184
2020-01-19 19:58:01 +00:00
Volker Lendecke
25bcf0e789 lib: Use closefrom() in smbrun.c
INSURE is never defined or used.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-01-19 18:29:39 +00:00
Volker Lendecke
42a3e2e503 ctdbd: Use struct initialization
2 lines less

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-01-19 18:29:39 +00:00
Volker Lendecke
b274bc698e dsdb: Use write_data() to write to the password check script
A simple write() might be interrupted or do short writes. Highly
unlikely, but if it happens, it will be impossible to diagnose.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-01-19 18:29:39 +00:00
Volker Lendecke
229518ec01 dsdb: Align integer types
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-01-19 18:29:39 +00:00
Volker Lendecke
37eb87d2be lib: Align integer types
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-01-19 18:29:39 +00:00
Andrew Bartlett
cffcc39f18 heimdal_build: Remove bashism from --address-sanitizer build rule
export FOO=bar is a Bash extension, and is not required in this case, we only need the asn1_compile
to run under the variable, there are no further commands in this sub-shell.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Isaac Boukris <iboukris@samba.org>

Autobuild-User(master): Isaac Boukris <iboukris@samba.org>
Autobuild-Date(master): Sat Jan 18 12:25:16 UTC 2020 on sn-devel-184
2020-01-18 12:25:16 +00:00
Ralph Boehme
7606800b79 smbd: avoid calling vfs_file_id_from_sbuf() if statinfo is not valid
When we're about to create a file, the stat info will be all zero, so
vfs_file_id_from_sbuf() would return a bogus file_id. This is normally not a
problem, as open_file() itself also calls vfs_file_id_from_sbuf() after having
created the file.

This is however a problem when using the VFS module fileid, as that is doing
caching of /etc/mtab and failing to find smb_fname->st.st_ex_dev (all zero in
this case when creating a new file) in the mtab cache will trigger a mtab reload
which can be *very* expensive.

Copying many small files to a Samba server in this situation will result in
abysimal performance.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14237

Pair-Programmed-With: Jeremy Allison <jra@samba.org>
Signed-off-by: Ralph Boehme <slow@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Fri Jan 17 22:38:14 UTC 2020 on sn-devel-184
2020-01-17 22:38:14 +00:00
Anoop C S
c9adf47ac5 vfs_glusterfs: Return fake fd from pipe() during open
GlusterFS currently doesn't have an API implementation to set flags on
open file descriptor. Thus we use pipe() to provide valid file descriptor
from the system.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14241

Signed-off-by: Anoop C S <anoopcs@redhat.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>

Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Fri Jan 17 17:14:43 UTC 2020 on sn-devel-184
2020-01-17 17:14:43 +00:00
Douglas Bagnall
6c7b722b3f fuzz_oLschema2ldif: check multiple possible NULLs
Address sanitizer will object to a theoretically possible NULL dereference
so we can't ignore these checks in set-up.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Fri Jan 17 14:33:18 UTC 2020 on sn-devel-184
2020-01-17 14:33:18 +00:00