1
0
mirror of https://github.com/samba-team/samba.git synced 2025-01-08 21:18:16 +03:00
Commit Graph

123753 Commits

Author SHA1 Message Date
Rowland Penny
ee79d39aa0 idmap_nss.8.xml: update manpage as discussed on the samba mailing
list

Signed-off-by: Rowland Penny <rpenny@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Fri Oct 30 17:11:02 UTC 2020 on sn-devel-184
2020-10-30 17:11:02 +00:00
Björn Jacke
e8f31e5c23 pam_winbind/ro.po: fix error from previous patch merge
fixes up d619a57804

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14491

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Björn Baumbach <bbaumbach@samba.org>

Autobuild-User(master): Björn Jacke <bjacke@samba.org>
Autobuild-Date(master): Thu Oct 29 20:49:16 UTC 2020 on sn-devel-184
2020-10-29 20:49:16 +00:00
Jule Anger
9214fcec34 tests: avoid returning an already used ID in randomXid()
The error 'uidNumber xxx is already being used.' in the samba tool tests
occurs when the random.randint functions returns the same value twice and
therefore a user or group with an already used gid or uid should be created.

Avoid this error by adding a list that stores the used IDs, so that the randomXid
function can check wheter a value is already used before returning it.

Signed-off-by: Jule Anger <ja@sernet.de>
Reviewed-by: Björn Baumbach <bb@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Oct 29 18:54:24 UTC 2020 on sn-devel-184
2020-10-29 18:54:24 +00:00
Andreas Schneider
ebd687335b python:tests: Add SAMR password change tests for fips
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Thu Oct 29 15:41:37 UTC 2020 on sn-devel-184
2020-10-29 15:41:37 +00:00
Andreas Schneider
9a3ba502d8 python:tests: Add SAMR password change tests for fips
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
2020-10-29 14:19:37 +00:00
Andreas Schneider
7d54e4b49c s4:param: Add 'weak crypto' getter to pyparam
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
2020-10-29 14:19:36 +00:00
Isaac Boukris
32d4c75d6c lib:crypto: Add py binding for set_relax/strict fips mode
Signed-off-by: Isaac Boukris <iboukris@gmail.com>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
2020-10-29 14:19:36 +00:00
Andreas Schneider
a9c532c6d3 s4:rpc_server: Allow to use RC4 for setting passwords
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
2020-10-29 14:19:36 +00:00
Andreas Schneider
c6a21e1897 s3:rpc_server: Allow to use RC4 for setting passwords
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
2020-10-29 14:19:36 +00:00
Andreas Schneider
5f1a73be63 s3:smbd: Use defines to set 'srv_smb_encrypt'
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
2020-10-29 14:19:36 +00:00
Andreas Schneider
8bbe5c8c94 librpc: Add dcerpc helper dcerpc_is_transport_encrypted()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
2020-10-29 14:19:36 +00:00
Andreas Schneider
905c2b9722 s3:smbd: Add SMB3 connection information to session info
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
2020-10-29 14:19:36 +00:00
Andreas Schneider
56879ec587 idl: Add SID_SAMBA_SMB3
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
2020-10-29 14:19:36 +00:00
Jeremy Allison
3076566d65 s3: smbd: Ensure change notifies can't get set unless the directory handle is open for SEC_DIR_LIST.
Remove knownfail entry.

CVE-2020-14318

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14434

Signed-off-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(master): Thu Oct 29 11:47:35 UTC 2020 on sn-devel-184
2020-10-29 11:47:35 +00:00
Jeremy Allison
6e143d9c7a s4: torture: Add smb2.notify.handle-permissions test.
Add knownfail entry.

CVE-2020-14318

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14434

Signed-off-by: Jeremy Allison <jra@samba.org>
2020-10-29 10:25:37 +00:00
Volker Lendecke
40f23c2459 CVE-2020-14323 torture4: Add a simple test for invalid lookup_sids winbind call
We can't add this test before the fix, add it to knownfail and have the fix
remove the knownfail entry again. As this crashes winbind, many tests after
this one will fail.

Reported by Bas Alberts of the GitHub Security Lab Team as GHSL-2020-134

Bug: https://bugzilla.samba.org/show_bug.cgi?id=14436
Signed-off-by: Volker Lendecke <vl@samba.org>
2020-10-29 10:25:37 +00:00
Volker Lendecke
a380f19d57 CVE-2020-14323 winbind: Fix invalid lookupsids DoS
A lookupsids request without extra_data will lead to "state->domain==NULL",
which makes winbindd_lookupsids_recv trying to dereference it.

Reported by Bas Alberts of the GitHub Security Lab Team as GHSL-2020-134

Bug: https://bugzilla.samba.org/show_bug.cgi?id=14436
Signed-off-by: Volker Lendecke <vl@samba.org>
2020-10-29 10:25:37 +00:00
Andrew Walker
cc4901123d s3:rpcclient fix NULL - deref caused by misuse of chgpasswd3
Passing wrong number of arguments to chgpasswd3 will cause rpcclient to crash.

Signed-off-by: Andrew Walker <awalker@ixsystems.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Oct 29 03:31:56 UTC 2020 on sn-devel-184
2020-10-29 03:31:56 +00:00
Andreas Schneider
5f92ec6988 s4:torture: Pass buffer correctly to write()
../../source4/torture/basic/denytest.c: In function ‘torture_createx_specific.isra’:
../../source4/torture/basic/denytest.c:2372:9: error: ‘write’ reading 56 bytes from a region of size 8 [-Werror=stringop-overflow=]
 2372 |   res = write(data_file_fd, &cxd, cxd_len);
      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14555

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Wed Oct 28 17:52:19 UTC 2020 on sn-devel-184
2020-10-28 17:52:19 +00:00
Mikhail Novosyolov
d619a57804 s3: update Russian translation of pam_winbind
Signed-off-by: Mikhail Novosyolov <m.novosyolov@rosalinux.ru>
Reviewed-by: Björn Jacke <bjacke@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>

Autobuild-User(master): Björn Jacke <bjacke@samba.org>
Autobuild-Date(master): Wed Oct 28 15:31:05 UTC 2020 on sn-devel-184
2020-10-28 15:31:05 +00:00
Mikhail Novosyolov
c69d710f20 s3: Rerun genmsg to update pam_winbind after 10 years
Previous run was in 2010 (10 years ago!), a lot of strings have changed.

Also removed all fuzzies because many strings do not exist any more in nterr.c
and then regenerated pos to restore strings that do exist.

I ran:
$ ./genmsg (with previous commits applied)
$ for i in *.po ; do mv -v $i ${i}.t && msgattrib --no-fuzzy -o $i ${i}.t && rm -fv ${i}.t ; done
$ ./genmsg

bjacke edited: don't remove old nterr.c translations, we should keep those
translatins and translate the mappings to the new strings coming from
nterr_gen.c, see b7b289f372 for the related
change.

Signed-off-by: Mikhail Novosyolov <m.novosyolov@rosalinux.ru>
Reviewed-by: Björn Jacke <bjacke@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
2020-10-28 14:04:31 +00:00
Mikhail Novosyolov
c218ad1a0a s3: update list of languages in genmsg of pam_winbind
Removed languages for which translations do not exist.

Signed-off-by: Mikhail Novosyolov <m.novosyolov@rosalinux.ru>
Reviewed-by: Björn Jacke <bjacke@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
2020-10-28 14:04:31 +00:00
Mikhail Novosyolov
7958abe324 s3: update paths in genmsg of pam_winbind
Signed-off-by: Mikhail Novosyolov <m.novosyolov@rosalinux.ru>
Reviewed-by: Björn Jacke <bjacke@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
2020-10-28 14:04:31 +00:00
Mikhail Novosyolov
341adfdf66 s3: fix running genmsg in pure git
xgettext wants pam_winbind.po to exist.
Without this running ./genmsg in cloned git fails.

Signed-off-by: Mikhail Novosyolov <m.novosyolov@rosalinux.ru>
Reviewed-by: Björn Jacke <bjacke@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
2020-10-28 14:04:31 +00:00
Alexander Bokovoy
3e27dc4847 daemons: report status to systemd even when running in foreground
When systemd launches samba services, the configuration we have in
systemd service files expects that the main process (/usr/sbin/*)
would use sd_notify() to report back its status. However, we only use
sd_notify() when running become_daemon().

As a result, samba/smbd/winbindd/nmbd processes never report back its
status and the status updates from other childs (smbd, winbindd, etc)
are not accepted as we now have implied NotifyAccess=main since commit
d1740fb3d5

This leads to a timeout and killing samba process by systemd. Situation
is reproducible in Fedora 33, for example.

Make sure that we have required status updates for all daemons in case
we aren't runnning in interactive mode.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14552

Signed-off-by: Alexander Bokovoy <ab@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Mon Oct 26 19:58:18 UTC 2020 on sn-devel-184
2020-10-26 19:58:17 +00:00
Alexander Bokovoy
183d5d63f4 DNS Resolver: support both dnspython before and after 2.0.0
`dnspython` 2.0.0 has many changes and several deprecations like:

```
> dns.resolver.resolve() has been added, allowing control of whether
search lists are used. dns.resolver.query() is retained for backwards
compatibility, but deprecated. The default for search list behavior can
be set at in the resolver object with the use_search_by_default
parameter. The default is False.

> dns.resolver.resolve_address() has been added, allowing easy
address-to-name lookups.
```

The new class `DNSResolver`:
- provides the compatibility layer
- defaults the previous behavior (the search list configured in the
  system's resolver configuration is used for relative names)
- defaults lifetime to 15sec (determines the number of seconds
  to spend trying to get an answer to the question)

The compatibility shim was developed by Stanislav Levin for FreeIPA and
adopted for Samba by Alexander Bokovoy.

Signed-off-by: Stanislav Levin <slev@altlinux.org>
Signed-off-by: Alexander Bokovoy <ab@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2020-10-26 18:33:40 +00:00
Volker Lendecke
bbc065da6e test: Check that notifyd messages actually change the database
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Sat Oct 24 07:20:17 UTC 2020 on sn-devel-184
2020-10-24 07:20:17 +00:00
Volker Lendecke
609867ef7c test: Add a first unit test for notifyd
Use the notifyd "messaging" protocol to check if notifyd works at all

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-10-24 05:57:31 +00:00
Volker Lendecke
741428eaed notifyd: Add fcn_wait_send()/recv()
tevent_req based functions to listen for file change
notifications. Mainly right now for testing purposes, but it could be
used to also implement smbd's file change notify in a more tevent_req
based fashion than it is implemented now.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-10-24 05:57:31 +00:00
Volker Lendecke
49859ac11d notifyd: Factor out notify_walk() into its own file
To be used in smbtorture, avoid having to include almost all of smbd
just for this

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-10-24 05:57:31 +00:00
Volker Lendecke
3e648e9d61 notifyd: Factor out notifyd_parse_entry() into its own file
The next step will be to factor out notifyd_parse_db() and and
notify_walk() for consumption outside of smbd. notifyd_parse_db()
needs access to the internal representation of notifyd's database, so
move it into a commonly usable file.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-10-24 05:57:31 +00:00
Volker Lendecke
4dac4859db notifyd: Fix a typo
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-10-24 05:57:31 +00:00
Volker Lendecke
79b0829ea2 notify: Remove an unused structure definition
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-10-24 05:57:31 +00:00
Volker Lendecke
5bb796cb25 lib: Fix includes for messages.h
It references struct tevent_context

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-10-24 05:57:31 +00:00
Ralph Boehme
0dad9a31cb smbd: add and use SMB2_FILE_ALL_INFORMATION
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Fri Oct 23 19:06:40 UTC 2020 on sn-devel-184
2020-10-23 19:06:40 +00:00
Ralph Boehme
f33b91a932 smbd: add and use SMB2_FILE_FULL_EA_INFORMATION
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-10-23 17:44:34 +00:00
Ralph Boehme
4b53e58340 s3: add and use MS-FSCC Codes from 2.4 and 2.5
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-10-23 17:44:34 +00:00
Ralph Boehme
7d9b32c881 smb: update comments on the NTCREATEX_FLAG_* flags
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-10-23 17:44:34 +00:00
Ralph Boehme
45017205c3 smb: rename NTCREATEX_OPTIONS_PRIVATE_STREAM_BASEOPEN to NTCREATEX_FLAG_STREAM_BASEOPEN
Just a shorter name, no change in behaviour.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-10-23 17:44:34 +00:00
Ralph Boehme
4481259f78 smb: rename NTCREATEX_OPTIONS_PRIVATE_DELETE_ON_CLOSE to NTCREATEX_FLAG_DELETE_ON_CLOSE
Just a shorter name, no change in behaviour.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-10-23 17:44:34 +00:00
Ralph Boehme
c2f0fd40da smb: rename NTCREATEX_OPTIONS_PRIVATE_DENY_FCB to NTCREATEX_FLAG_DENY_FCB
Just a shorter name, no change in behaviour.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-10-23 17:44:33 +00:00
Ralph Boehme
6da16727e1 smb: rename NTCREATEX_OPTIONS_PRIVATE_DENY_DOS to NTCREATEX_FLAG_DENY_DOS
Just a shorter name, no change in behaviour.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-10-23 17:44:33 +00:00
Stefan Metzmacher
d08a6b4200 librpc/dcesrv_core: let dcesrv_call_dispatch_local() call context->iface->reply()
This is needed in order to get NDR_PRINT_FUNCTION_DEBUG(..., NDR_OUT) called.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14551

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Samuel Cabrero <scabrero@samba.org>

Autobuild-User(master): Samuel Cabrero <scabrero@samba.org>
Autobuild-Date(master): Fri Oct 23 17:24:37 UTC 2020 on sn-devel-184
2020-10-23 17:24:37 +00:00
Stefan Metzmacher
7bd321e71b librpc/dcesrv_core: assert that dcesrv_call_dispatch_local() never gets async.
This is just not supported for now...

We would need a dcesrv_call_dispatch_local_send/recv in order to
support async calls.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14551

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Samuel Cabrero <scabrero@samba.org>
2020-10-23 16:02:37 +00:00
Stefan Metzmacher
42e79cee3d librpc/dcesrv_core: make use of dcerpc_fault_to_nt_status() in dcesrv_call_dispatch_local()
The caller wants to get a useful NTSTATUS instead of a generic
NT_STATUS_NET_WRITE_FAULT.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14551

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Samuel Cabrero <scabrero@samba.org>
2020-10-23 16:02:37 +00:00
Stefan Metzmacher
7c8a7e8a15 librpc/dcesrv_core: move two rpcint_dispatch() copies into dcesrv_call_dispatch_local()
We only need this function once, so that we need to fix bugs only once...

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14551

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Samuel Cabrero <scabrero@samba.org>
2020-10-23 16:02:37 +00:00
Andreas Schneider
3b5b23ea84 examples:auth: Do not install example plugin
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14550

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Fri Oct 23 15:32:08 UTC 2020 on sn-devel-184
2020-10-23 15:32:08 +00:00
Andreas Schneider
6e25613a31 s3:modules: Do not install vfs modules only used for testing
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14550

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
2020-10-23 14:09:43 +00:00
Andreas Schneider
2d89ddb012 unittests: Mark test binaries for selftest
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14550

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
2020-10-23 14:09:43 +00:00
Andreas Schneider
8fa0d3331b buildtools: Do not install binaries which are for selftest
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14550

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
2020-10-23 14:09:43 +00:00