1
0
mirror of https://github.com/samba-team/samba.git synced 2025-01-11 05:18:09 +03:00
Commit Graph

36561 Commits

Author SHA1 Message Date
Gary Lockyer
f467727db5 CVE-2020-10704: lib util asn1: Add ASN.1 max tree depth
Add maximum parse tree depth to the call to asn1_init, which will be
used to limit the depth of the ASN.1 parse tree.

Credit to OSS-Fuzz

REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20454
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14334

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-05-04 02:59:31 +00:00
Ralph Boehme
aa3b3e18a7 s4/torture: add a comprehensive "non-lease-break-trigger" access mask test case
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14357

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-04-30 19:32:45 +00:00
Ralph Boehme
4371c62f2c s4/torture: add a comprehensive "non-oplock-break-trigger" access mask test case
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14357

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2020-04-30 19:32:44 +00:00
Andreas Schneider
a454c9cd42 testprogs: Add client kerberos test
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Wed Apr 29 11:53:41 UTC 2020 on sn-devel-184
2020-04-29 11:53:41 +00:00
Andreas Schneider
9596eefbd5 s4:torture: Print account and authority name
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
2020-04-29 10:15:28 +00:00
David Mulder
dedb4f24af s4:torture: Convert samba3.raw.mkdir test to smb2
Signed-off-by: David Mulder <dmulder@suse.com>
Reviewed-by: Noel Power <noel.power@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 888abcaf8ffbec45fc47520bd3f544e3aa6f58f2)

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Apr 28 19:46:32 UTC 2020 on sn-devel-184
2020-04-28 19:46:32 +00:00
David Mulder
34311553d7 s4:torture: Convert samba4.base.tcon test to smb2
Signed-off-by: David Mulder <dmulder@suse.com>
Reviewed-by: Noel Power <noel.power@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit eb167bc43dbe196ef5b3bfd24160c72c74113dea)
2020-04-28 18:09:39 +00:00
David Mulder
c690428ebe Convert samba4.base.mangle test to smb2
Signed-off-by: David Mulder <dmulder@suse.com>
Reviewed-by: Noel Power <noel.power@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 9437b44668c9f7742d6d4fe0891ac4d9fda7c804)
2020-04-28 18:09:39 +00:00
David Mulder
18db8bd9c4 Implement alt name query for smb2
Implements smb2_qpathinfo_alt_name() and
RAW_FILEINFO_SMB2_ALT_NAME_INFORMATION.

Signed-off-by: David Mulder <dmulder@suse.com>
Reviewed-by: Noel Power <noel.power@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 097df343ce21c8340aee7f42f233fe74b92b47e2)
2020-04-28 18:09:39 +00:00
David Mulder
67e589c111 Convert samba4.base.maximum_allowed to smb2
Signed-off-by: David Mulder <dmulder@suse.com>
Reviewed-by: Noel Power <noel.power@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit d9edfeea668362269d812f82b1957ed16ff56dd4)
2020-04-28 18:09:39 +00:00
David Mulder
a3ddd679d7 Add SMB2 lsa helper routines
Signed-off-by: David Mulder <dmulder@suse.com>
Reviewed-by: Noel Power <noel.power@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 3763052c2a95ac9bd60f00458389a5245cf5d58d)
2020-04-28 18:09:39 +00:00
Andrew Bartlett
54a3560498 provision: Remove final code for the LDAP backend
The LDAP backend for the Samba AD DC, aiming to store the AD DC in
an existing LDAP server was largely removed many years aga, but the
other parts were removed in 2b0fc74a09.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Thu Apr 23 06:12:20 UTC 2020 on sn-devel-184
2020-04-23 06:12:20 +00:00
Andrew Bartlett
4ab753f0d1 source4/setup: Remove files unused since the LDAP backend was removed
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2020-04-23 04:36:29 +00:00
Jeremy Allison
72a57d377e s4: torture: SMB2. Fix smb2.winattr to actually read the SD from the server and check it.
We need READ_CONTROL, and actually have to ask for
the OWNER|GROUP|DACL bits if we're going to properly
check the SD.

Tested against Windows 10.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Apr 16 20:42:58 UTC 2020 on sn-devel-184
2020-04-16 20:42:58 +00:00
Jeremy Allison
cb59b75bee s4: torture: SMB2. Add a new test that exposes interesting SD query behavior.
If we open a file without READ_CONTROL, requesting a security
descriptor fails with ACCESS_DENIED if any of the requested
bits OWNER|GROUP|DACL are set.

However, if we send zero as the requested bits then a
security descriptor is returned containing no data,
even though reading an SD should fail based on the
access permissions we have on the handle.

This has been tested against Windows 10, and also
passes on Samba - although in smbd we actually
read the SD off disk first, before nulling out
all the data we read. We shouldn't (we have
no rights to do so) and a subsequent commit
will fix this.

This was discovered when investigating the
smb2.winattr test, which currently relies
on exactly this behavior. It shouldn't
and the next commit will fix that.

I wanted to preserve the current smb2.winattr
behavior in a test though.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-04-16 19:07:35 +00:00
Ralph Boehme
eab086c572 s4/torture: fix timeval wrap in torture_libsmbclient_utimes() test
Fixes the following flapping test:

UNEXPECTED(failure): samba4.libsmbclient.utimes.SMB3.utimes(nt4_dc)
REASON: Exception: Exception: ../../source4/torture/libsmbclient/libsmbclient.c:1249:
    st.st_mtim.tv_nsec / 1000 was 98181 (0x17F85),
    expected 1098181 (0x10C1C5): smbc_utimes did not update msec

https://gitlab.com/samba-team/devel/samba/-/jobs/506361470

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Sat Apr 11 12:24:00 UTC 2020 on sn-devel-184
2020-04-11 12:23:59 +00:00
Volker Lendecke
833303b8bd torture: Test smbc_utimes()
Prove that smbc_utimes throws away the tv_nsec field

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-04-08 14:46:40 +00:00
Volker Lendecke
f261d5f727 torture4: Allow DBG output in libsmbclient tests
smbc_new_context() overwrites the global DEBUGLEVEL to 0.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-04-08 14:46:39 +00:00
Andreas Schneider
ff67642dc2 tests: Add test to check the server doesn't allow NTLM
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
2020-04-08 13:02:40 +00:00
Andreas Schneider
ab3394f9f5 s4:tls: Fix generating TLS RSA certs with FIPS140-2
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
2020-04-08 13:02:39 +00:00
Andreas Schneider
ecdd17c536 s4:samdb: Do not create WDdigests for HTTP if weak crypto is disabled
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
2020-04-08 13:02:39 +00:00
Noel Power
0463960488 s4/selftest: Move samba4.rpc.join tests to ad_dc_default_smb1
The following tests which fail when run against a test env that
doesn't support SMB1

samba4.rpc.join on ncacn_ip_tcp with bigendian(ad_dc_default)
samba4.rpc.join on ncacn_ip_tcp with seal,padcheck(ad_dc_default)
samba4.rpc.join on ncacn_ip_tcp with validate(ad_dc_default)
samba4.rpc.join on ncacn_np with bigendian(ad_dc_default)
samba4.rpc.join on ncacn_np with seal,padcheck(ad_dc_default)
samba4.rpc.join on ncacn_np with validate(ad_dc_default)
samba4.rpc.join on ncalrpc with bigendian(ad_dc_default:local)
samba4.rpc.join on ncalrpc with seal,padcheck(ad_dc_default:local)
samba4.rpc.join on ncalrpc with validate(ad_dc_default:local)

have been moved to ad_dc_default_smb1

results verified with

VALIDATE="validate" python3 source4/selftest/tests.py | grep "^samba4.rpc.join" | grep ad_dc_default | sort

corrosponding entries have been removed from skip_smb1_fail

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-04-03 15:08:32 +00:00
Noel Power
e362ad23ee s4/selftest: Move samba4.ldap.passwordsettings to ad_dc_default_smb1
Test samba4.ldap.passwordsettings fails when run against test env that
doesn't support SMB1 so move to ad_dc_default_smb1

Note: no skip entries to be removed as tests are known failures

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-04-03 15:08:32 +00:00
Noel Power
1553641724 s4/selftest: Move samba4.ldap.nested-search to ad_dc_default_smb1
Test samba4.ldap.nested-search fails when run against test env
that doesn't support SMB1 so move to ad_dc_default_smb1

Also remove entry from skip_smb1_fail

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-04-03 15:08:32 +00:00
Noel Power
c83fafacbb s4/selftest: Modify samba4.blackbox.chgdcpass to use smbclient(s3)
Test was using smbclient4 but this fails when used in environments that
don't support SMB1. We use smbclient(s3) instead. There remains one
failure due to behaviour differences between the smbclients.

The behavioural changes are related not to SMB1/SMB2 but
commits d4ea637eb8 &
fce66b22ea

Perhaps we need to modify s3 smbclient in a similar way? This is however
something that deserves further discussion.

Move this failing part to a knownfail for the moment.

Also the corrosponding entry in skip_smb1_fail has been removed

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-04-03 15:08:32 +00:00
Noel Power
aa688a8de6 s4/selftest: Move samba.tests.libsmb to nt4_dc_smb1
Also remove associated entry from skip_smb1_fail

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-04-03 15:08:32 +00:00
Noel Power
572bc3e643 s4/selftest: Adjust samba4.blackbox.pkinit to use (s3) smbclient
samba4.blackbox.pkinit falls to pass in environments that don't support
SMB2 because of use (s4) smbclient4. Change test to use (s3) smbclient

Additionally a test within the test script test_kinit_trusts_heimdal.sh
explicitly uses smbclient4 which can't negotiate SMB1 in environments
that don't support it. Add knownfail to cater for this & also remove entry
from the skip file

Further reference the smbclient4 specific test is associated with
https://bugzilla.samba.org/show_bug.cgi?id=12554 so maybe we should
keep it for the moment

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-04-03 15:08:30 +00:00
Noel Power
4c92489383 s4/selftest: Move samba.tests.net_join_no_spnego to ad_dc_smb1
Test samba.tests.net_join_no_spnego when run in environment
doesn't support SMB1 so move it to ad_dc_smb1 and remove
skip_smb1_fail entry

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-04-03 15:08:30 +00:00
Noel Power
6edb46682d s4/selftest: Move samba.tests.auth_log_pass_change to ad_dc_smb1
Test samba.tests.auth_log_pass_change  will fail when run against
environments that don't support SMB1 so move this test to ad_dc_smb1
and remove entry from skip_smb1_fail

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-04-03 15:08:30 +00:00
Noel Power
fc1121bc6b s4/selftest: Move samba.tests.auth_log to ad_dc_smb1
Test samba.tests.auth_log will fail when run against environments that
don't support SMB1 so move this test to ad_dc_smb1 and removing
entry from skip_smb1_fail

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-04-03 15:08:29 +00:00
Noel Power
a166ddc740 s4/selftest: Move samba4.smb.spnego to ad_dc_smb1
Moving

samba4.smb.spnego.krb5.no_optimistic(ad_dc)
samba4.smb.spnego.ntlmssp.no_optimistic(ad_dc)

and additionally removing the entries from skip_smb1_fails

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-04-03 15:08:29 +00:00
Noel Power
ed3b15b33c s4/selftest: Move samba4.rpc.join tests from ad_dc to ad_dc_smb1
Move the following tests from ad_dc to ad_dc_smb1

samba4.rpc.join with bigendian(ad_dc)
samba4.rpc.join with seal,padcheck(ad_dc)
samba4.rpc.join with validate(ad_dc)

and additionally remove the corrosponding entries from skip_smb1_fails

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-04-03 15:08:29 +00:00
Noel Power
b056425340 s4/selftest: Move failing samba4.rpc.authcontext.* (ad_dc) to ad_dc_smb1
Move
samba4.rpc.authcontext with bigendian(ad_dc)
samba4.rpc.authcontext with seal,padcheck(ad_dc)
samba4.rpc.authcontext with validate(ad_dc)

to ad_dc_smb1 environment and remove the corrosponding entries in
skip_smb1_fail

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-04-03 15:08:29 +00:00
Noel Power
1c8974b421 s4/selftest: run samba4.libsmbclient.*.NT1.* tests in ad_dc_smb1
additionally remove those related entries from skip_smb1_fails

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-04-03 15:08:29 +00:00
Noel Power
0aa44c88d2 s4/selftest: move samba4.dfs.domain to ad_dc_smb1
Additionally remove the test entry from skip_smb1_fails

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-04-03 15:08:29 +00:00
Noel Power
422e6c5a79 s4/selftest: adjust samba.blackbox.pdbtest to use (s3) smbclient
smbclient4 only negotiates smb1, this test should use smbclient(s3)
instead.

Signed-off-by: Noel Power <npower@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-04-03 15:08:28 +00:00
Noel Power
7e04d84b5f s4/selftest: Adjust samba4.blackbox.samba_tool to use (s3) smbclient
(s4) smbclient doesn't negotiate smb2, (s3) smbclient is what
is used and what we really should be testing.

Additionally remove entry from ski_smb1_fails file

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-04-03 15:08:28 +00:00
Noel Power
1c3f954ab4 s4/selftest: Use (s3) smbclient for test samba4.blackbox.kinit
Additionally we remove the entry from skip_smb1_fails as it is
no longer relevant

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-04-03 15:08:28 +00:00
Noel Power
3558332228 s4/selftest: Use s3 smbclient for samba4.blackbox.bogusdomain
Additionally remove the test from skip_smb1_fails

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-04-03 15:08:28 +00:00
Noel Power
87d77b3ea9 s4/selftest: Add smbclient (s3 version) binary to s4/tests
smbclient4 only negotiates smb1, tests probably should use smbclient
instead (except for tests that intentionally are testing smbclient4
itself)

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-04-03 15:08:28 +00:00
Andrew Bartlett
9f9b80c79a dlz_bind9: Avoid talloc_new(NULL), use a parent variable
This will help provide a better memory tree if we ever suspect a problem
here.  The tmp_ctx varaible is always freed before the end of this
function.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2020-04-01 08:51:31 +00:00
Stefan Metzmacher
c4ccdf4b30 s4:selftest: run samba.tests.krb5.simple_tests against ad_dc_default
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Isaac Boukris <iboukris@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Fri Mar 27 19:54:25 UTC 2020 on sn-devel-184
2020-03-27 19:54:25 +00:00
Stefan Metzmacher
7010a1311d s4:selftest: run samba.tests.krb5.kcrypto test
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Isaac Boukris <iboukris@samba.org>
2020-03-27 18:17:35 +00:00
Stefan Metzmacher
05d3a909d5 selftest: use 10.53.57.0/8 instead of 127.0.0.1/8
This makes our testing much more realistic and allows
the removal of some knowfail entries.

It also means the testing with network namespaces on Linux
can use the same addresses as our socket wrapper testing.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2020-03-27 09:02:38 +00:00
Stefan Metzmacher
4d6864e08e samba_dnsupdate: fix delete (samba-tool) message
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2020-03-27 09:02:37 +00:00
Stefan Metzmacher
88500f7326 samba_dnsupdate: fix --no-credentials handling
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2020-03-27 09:02:37 +00:00
Stefan Metzmacher
bc94d9878d s4:torture/ldb: fix the build on FreeBSD
clock_t is 'int' instead' of 'long' there.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2020-03-27 09:02:37 +00:00
Volker Lendecke
e74e85ee66 dsdb: Use ARRAY_DEL_ELEMENT() in dirsync_filter_entry()
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2020-03-26 14:43:31 +00:00
Volker Lendecke
f52f531771 lib: Remove unused SOCKET_FLAG_BLOCK
Nobody in the code set this flag, so remove it

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2020-03-25 09:04:28 +00:00
Andrew Bartlett
4d65e3ad21 s4-librpc: Simplify bytes or unicode input checking in python GUID() bindings
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Noel Power <npower@samba.org>
2020-03-23 19:12:43 +00:00