5 Commits

Author	SHA1	Message	Date
Andrew Bartlett	cfeb9fe50e	CVE-2023-4154: Unimplement the original DirSync behaviour without LDAP_DIRSYNC_OBJECT_SECURITY ... This makes LDAP_DIRSYNC_OBJECT_SECURITY the only behaviour provided by Samba. Having a second access control system withing the LDAP stack is unsafe and this layer is incomplete. The current system gives all accounts that have been given the GUID_DRS_GET_CHANGES extended right SYSTEM access. Currently in Samba this equates to full access to passwords as well as "RODC Filtered attributes" (often used with confidential attributes). Rather than attempting to correctly filter for secrets (passwords) and these filtered attributes, as well as preventing search expressions for both, we leave this complexity to the acl_read module which has this facility already well tested. The implication is that callers will only see and filter by attribute in DirSync that they could without DirSync. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15424 Signed-off-by: Andrew Bartlett <abartlet@samba.org>	2023-10-10 14:49:39 +00:00
Andrew Bartlett	d3d83a8f2e	CVE-2023-4154 dsdb/tests: Extend attribute read DirSync tests ... The aim here is to document the expected (even if not implemented) SEARCH_FLAG_RODC_ATTRIBUTE vs SEARCH_FLAG_CONFIDENTIAL, behaviour, so that any change once CVE-2023-4154 is fixed can be noted. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15424 Signed-off-by: Andrew Bartlett <abartlet@samba.org>	2023-10-10 14:49:39 +00:00
Andrew Bartlett	76b8d3edce	CVE-2023-4154 dsdb/tests: Check that secret attributes are not visible with DirSync ever. ... BUG: https://bugzilla.samba.org/show_bug.cgi?id=15424 Signed-off-by: Andrew Bartlett <abartlet@samba.org>	2023-10-10 14:49:39 +00:00
Andrew Bartlett	03205663b3	CVE-2019-14847 dsdb: Correct behaviour of ranged_results when combined with dirsync ... BUG: https://bugzilla.samba.org/show_bug.cgi?id=14040 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org> Autobuild-Date(master): Thu Oct 31 23:29:15 UTC 2019 on sn-devel-184	2019-10-31 23:29:14 +00:00
Andrew Bartlett	e62c535d5b	CVE-2019-14847 dsdb: Demonstrate the correct interaction of ranged_results style attributes and dirsync ... Incremental results are provided by a flag on the dirsync control, not by changing the attribute name. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14040 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>	2019-10-31 22:07:40 +00:00