Douglas Bagnall [Tue, 16 Jun 2015 23:37:03 +0000 (11:37 +1200)]
Treat unsigned 64 bit IDL values as unsigned long long in Python
This caused a compilation error on i386:
default/librpc/gen_ndr/py_server_id.c:216:75: error: overflow in implicit constant conversion [-Werror=overflow]
PyModule_AddObject(m, "SERVERID_UNIQUE_ID_NOT_TO_VERIFY", PyInt_FromLong(0xFFFFFFFFFFFFFFFFULL));
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Douglas Bagnall [Tue, 16 Jun 2015 23:01:10 +0000 (11:01 +1200)]
Byte order reversal shouldn't assume size_t is 64 bit.
This fixes compilation on 32 bit i386 with -WError.
../lib/crypto/aes_gcm_128.c:213:2: error: right shift count >= width of type [-Werror]
../lib/crypto/aes_gcm_128.c:213:2: error: left shift count >= width of type [-Werror]
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Stefan Metzmacher [Tue, 23 Jun 2015 10:32:34 +0000 (12:32 +0200)]
s4:gensec/gssapi: make use of add gssapi_get_sig_size() and gssapi_{seal,unseal,sign,check}_packet() helper functions
This way are able to support GENSEC_FEATURE_SIGN_PKT_HEADER also together with
GENSEC_FEATURE_SEAL.
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Jun 24 04:00:43 CEST 2015 on sn-devel-104
Stefan Metzmacher [Sun, 21 Jun 2015 23:23:16 +0000 (01:23 +0200)]
s3:librpc/gse: make use of add gssapi_get_sig_size() and gssapi_{seal,unseal,sign,check}_packet() helper functions
This way are able to support GENSEC_FEATURE_SIGN_PKT_HEADER.
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Stefan Metzmacher [Thu, 25 Sep 2008 06:34:48 +0000 (08:34 +0200)]
auth/kerberos: add gssapi_get_sig_size() and gssapi_{seal,unseal,sign,check}_packet() helper functions
These make use of gss_[un]wrap_iov[_length]() where required and support
header signing.
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Stefan Metzmacher [Tue, 11 Aug 2009 17:48:50 +0000 (19:48 +0200)]
heimdal:lib/gssapi/krb5: implement gss_[un]wrap_iov[_length] with arcfour-hmac-md5
Pair-Programmed-With: Andreas Schneider <asn@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Stefan Metzmacher [Thu, 18 Jun 2015 12:07:43 +0000 (14:07 +0200)]
heimdal:lib/gssapi/krb5: split out a arcfour_mic_cksum_iov() function
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Stefan Metzmacher [Thu, 18 Jun 2015 13:42:03 +0000 (15:42 +0200)]
heimdal:lib/gssapi/krb5: add const to arcfour_mic_key()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Stefan Metzmacher [Thu, 18 Jun 2015 12:06:57 +0000 (14:06 +0200)]
heimdal:lib/gssapi/krb5: clear temporary buffer with cleartext data.
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Stefan Metzmacher [Thu, 18 Jun 2015 10:20:26 +0000 (12:20 +0200)]
heimdal:lib/gssapi/krb5: fix indentation in _gk_wrap_iov()
Now it matches _gk_unwrap_iov() and _gk_wrap_iov_length().
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Stefan Metzmacher [Thu, 18 Jun 2015 13:43:32 +0000 (15:43 +0200)]
heimdal:lib/gssapi/krb5: make _gssapi_verify_pad() more robust
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Stefan Metzmacher [Fri, 27 Mar 2015 13:41:19 +0000 (14:41 +0100)]
s4:selftest: add torture:run_removedollar_test=true to the machine account kdc tests
Bug: https://bugzilla.samba.org/show_bug.cgi?id=11130
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Stefan Metzmacher [Fri, 27 Mar 2015 13:41:19 +0000 (14:41 +0100)]
s4:torture/krb5: add a --option=torture:run_removedollar_test=true option to kdc-conon
With this option a machine account is tested without the trailing '$'
in the account name.
Bug: https://bugzilla.samba.org/show_bug.cgi?id=11130
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Stefan Metzmacher [Mon, 23 Mar 2015 22:10:02 +0000 (22:10 +0000)]
s4:selftest: run samba4.rpc.lsa.secrets with more principal combinations
'dcom/SERVER', 'SERVER$' and 'SERVER' as target principal names.
Bug: https://bugzilla.samba.org/show_bug.cgi?id=11130
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Stefan Metzmacher [Mon, 23 Mar 2015 10:00:51 +0000 (10:00 +0000)]
s4:kdc/db-glue: allow principals in form of computer@EXAMPLE.COM
This should be translated to computer$@EXAMPLE.COM.
Note the behavior differs between client and server lookup.
In samba_kdc_lookup_client() we need to fallback in case of
NO_SUCH_USER. samba_kdc_lookup_server() needs to do a single search
and only use the result if it's unique.
Bug: https://bugzilla.samba.org/show_bug.cgi?id=11130
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Stefan Metzmacher [Thu, 11 Jun 2015 18:04:09 +0000 (20:04 +0200)]
s4:kdc/db-glue: fix memory leak in samba_kdc_lookup_server()
We need to free enterprise_principal if generated.
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Volker Lendecke [Tue, 23 Jun 2015 12:58:11 +0000 (14:58 +0200)]
dsdb: Fix CID
1034902 Dereference before null check
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Wed Jun 24 01:02:22 CEST 2015 on sn-devel-104
Volker Lendecke [Tue, 23 Jun 2015 12:56:50 +0000 (14:56 +0200)]
dsdb: Fix CID
1034687 Logically dead code
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Volker Lendecke [Tue, 23 Jun 2015 12:53:39 +0000 (14:53 +0200)]
dsdb: Fix CID
1034719 Evaluation order violation
We assigned lp_ctx twice...
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Volker Lendecke [Tue, 23 Jun 2015 12:46:12 +0000 (14:46 +0200)]
dsdb: Fix CID
1034802 Dereference null return value
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Volker Lendecke [Tue, 23 Jun 2015 12:44:05 +0000 (14:44 +0200)]
dsdb: Fix CID
1034742 Dereference after null check
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Volker Lendecke [Tue, 23 Jun 2015 12:42:06 +0000 (14:42 +0200)]
dsdb: Fix CID
1034743 Dereference after null check
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Volker Lendecke [Tue, 23 Jun 2015 12:40:42 +0000 (14:40 +0200)]
dsdb: Fix CID
1034803 Dereference null return value
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Volker Lendecke [Tue, 23 Jun 2015 12:39:58 +0000 (14:39 +0200)]
dsdb: Fix CID
1034804 Dereference null return value
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Volker Lendecke [Tue, 23 Jun 2015 10:48:13 +0000 (12:48 +0200)]
dsdb: Fix CID
1034745 Dereference after null check
This is a cut&paste error
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Volker Lendecke [Tue, 23 Jun 2015 10:02:06 +0000 (12:02 +0200)]
smbd: Fix CID
1273096 Dereference before null check
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Volker Lendecke [Tue, 23 Jun 2015 09:22:04 +0000 (11:22 +0200)]
lib: Remove unused functions
This fixes CID
1034629 Unchecked return value
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Volker Lendecke [Tue, 23 Jun 2015 09:06:02 +0000 (11:06 +0200)]
lib: Fix CID
1128556 Dereference after null check
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Volker Lendecke [Tue, 23 Jun 2015 09:03:47 +0000 (11:03 +0200)]
lib: Fix CID
1272858 Copy-paste error
Coverity is wrong here, but it's a good idea to consolidate the close-loop
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Volker Lendecke [Tue, 23 Jun 2015 08:18:31 +0000 (10:18 +0200)]
lib: Fix CID 710685 Unchecked return value from library
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Volker Lendecke [Tue, 23 Jun 2015 08:12:15 +0000 (10:12 +0200)]
lib: Fix CID
1273234 Untrusted value as argument
buf->size has been sanitized in the checks done in talloc_array(). This makes
the "trust" flow more explicit.
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Volker Lendecke [Tue, 23 Jun 2015 08:10:19 +0000 (10:10 +0200)]
lib: Fix CID
1034723 Explicit null dereferenced
Do an early return if there's nothing to receive
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Volker Lendecke [Tue, 23 Jun 2015 08:02:17 +0000 (10:02 +0200)]
lib: Fix CID
1272913 Calling risky function
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Volker Lendecke [Tue, 23 Jun 2015 07:56:55 +0000 (09:56 +0200)]
lib: Make genrand independent
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Volker Lendecke [Tue, 23 Jun 2015 08:40:33 +0000 (10:40 +0200)]
lib: Make time-basic a library
The next commit will make genrand depend on time-basic. Without this, we would
link in time-basic twice, from samba-debug and from genrand.
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Volker Lendecke [Tue, 23 Jun 2015 07:53:15 +0000 (09:53 +0200)]
lib: Fix deps for LIBCRYPTO
LIBCRYPTO itself does not depend on talloc
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Volker Lendecke [Tue, 23 Jun 2015 07:52:49 +0000 (09:52 +0200)]
lib: Simplify arcfour_crypt
We don't need a dependency on data_blob in crypto
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Volker Lendecke [Tue, 23 Jun 2015 07:28:28 +0000 (09:28 +0200)]
lib: Streamline genrand.c includes
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Volker Lendecke [Tue, 23 Jun 2015 07:05:56 +0000 (09:05 +0200)]
lib: Fix whitespace
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Volker Lendecke [Tue, 23 Jun 2015 07:02:46 +0000 (09:02 +0200)]
lib: Strip genrand.c a bit
This moves for example password complexity checks out of the core random
number generator
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Stefan Metzmacher [Sat, 20 Jun 2015 14:54:33 +0000 (16:54 +0200)]
s3:ntlm_auth: don't start gensec backend twice
ntlm_auth_start_ntlmssp_server() was used in two cases
and both call gensec_start_mech_by_oid() again.
So we remove gensec_start_mech_by_oid() and rename the function
to ntlm_auth_prepare_gensec_server.
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Stefan Metzmacher [Fri, 19 Jun 2015 10:47:10 +0000 (12:47 +0200)]
auth/gensec: remove unused gensec_[un]wrap_packets() hooks
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Stefan Metzmacher [Fri, 19 Jun 2015 10:46:27 +0000 (12:46 +0200)]
s4:auth/gensec: remove unused gensec_socket_init()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Stefan Metzmacher [Fri, 19 Jun 2015 11:47:29 +0000 (13:47 +0200)]
s4:auth/gensec: remove unused include of lib/socket/socket.h
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Stefan Metzmacher [Fri, 19 Jun 2015 11:30:54 +0000 (13:30 +0200)]
s4:auth/gensec: remove unused and untested cyrus_sasl module
There's not a high chance that this module worked at all.
Requesting SASL_SSF in order to get the max input length
is completely broken.
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Stefan Metzmacher [Fri, 19 Jun 2015 10:26:06 +0000 (12:26 +0200)]
s4:libcli/ldap: conversion to tstream
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Stefan Metzmacher [Fri, 19 Jun 2015 11:30:10 +0000 (13:30 +0200)]
s4:lib/tls: ignore non-existing ca and crl files in tstream_tls_params_client()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Stefan Metzmacher [Fri, 19 Jun 2015 10:26:55 +0000 (12:26 +0200)]
s4:lib/tls: fix tstream_tls_connect_send() define
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Stefan Metzmacher [Thu, 18 Jun 2015 23:07:49 +0000 (01:07 +0200)]
s3:libads/sasl: use gensec_max_{input,wrapped}_size() in ads_sasl_spnego_ntlmssp_bind
gensec_sig_size() is for gensec_{sign,seal}_packet() instead of gensec_wrap().
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Stefan Metzmacher [Thu, 18 Jun 2015 19:07:58 +0000 (21:07 +0200)]
s4:gensec/gssapi: make calculation of gensec_gssapi_sig_size() for aes keys more clear
This way the result matches what gss_wrap_iov_length() would return.
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Stefan Metzmacher [Thu, 18 Jun 2015 21:18:58 +0000 (23:18 +0200)]
s4:gensec/gssapi: use gensec_gssapi_max_{input,wrapped}_size() for all backends
This avoids calls to gensec_gssapi_sig_size() as fallback in
gensec_max_input_size().
gensec_gssapi_sig_size() needs to report the sig size
gensec_{sign,seal}_packet(), which could be different to the
overhead produced by gensec_wrap().
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Stefan Metzmacher [Tue, 23 Jun 2015 08:27:27 +0000 (10:27 +0200)]
s4:selftest: also run rpc.winreg with kerberos and all possible auth options
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11061
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Tue Jun 23 17:31:08 CEST 2015 on sn-devel-104
Stefan Metzmacher [Thu, 18 Jun 2015 22:35:29 +0000 (00:35 +0200)]
s4:selftest: run rpc.echo tests also with krb5 krb5,sign krb5,seal
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11061
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Stefan Metzmacher [Sat, 20 Jun 2015 15:49:02 +0000 (17:49 +0200)]
s4:rpc_server: fix padding caclucation in dcesrv_auth_response()
This is simplified by using DCERPC_AUTH_PAD_LENGTH() and changes the behaviour
so that we will use no padding if the stub_length is already aligned
to DCERPC_AUTH_PAD_ALIGNMENT (16 bytes).
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11061
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Stefan Metzmacher [Sat, 20 Jun 2015 15:47:14 +0000 (17:47 +0200)]
s4:rpc_server: let dcesrv_auth_response() handle sig_size == 0 with auth_info as error
Don't send plaintext on the wire because of an internal error...
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11061
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Stefan Metzmacher [Fri, 19 Jun 2015 20:35:44 +0000 (22:35 +0200)]
s4:rpc_server: let dcesrv_reply() use a sig_size for a padded payload
The sig_size could differ depending on the aligment/padding.
So should use the same alignment as we use for the payload.
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Stefan Metzmacher [Fri, 19 Jun 2015 20:35:44 +0000 (22:35 +0200)]
s4:rpc_server: let dcesrv_reply() use DCERPC_AUTH_PAD_ALIGNMENT define
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Stefan Metzmacher [Sat, 20 Jun 2015 15:49:02 +0000 (17:49 +0200)]
s4:librpc/rpc: fix padding caclucation in ncacn_push_request_sign()
This is simplified by using DCERPC_AUTH_PAD_LENGTH() and changes the behaviour
so that we will use no padding if the stub_length is already aligned
to DCERPC_AUTH_PAD_ALIGNMENT (16 bytes).
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11061
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Stefan Metzmacher [Sat, 20 Jun 2015 15:47:14 +0000 (17:47 +0200)]
s4:librpc/rpc: let ncacn_push_request_sign() handle sig_size == 0 with auth_info as internal error
Don't send plaintext on the wire because of an internal error...
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11061
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Stefan Metzmacher [Fri, 19 Jun 2015 20:35:44 +0000 (22:35 +0200)]
s4:librpc/rpc: let dcerpc_ship_next_request() use a sig_size for a padded payload
The sig_size could differ depending on the aligment/padding.
So should use the same alignment as we use for the payload.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11061
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Stefan Metzmacher [Fri, 19 Jun 2015 20:35:44 +0000 (22:35 +0200)]
s4:librpc/rpc: let dcerpc_ship_next_request() use DCERPC_AUTH_PAD_ALIGNMENT define
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11061
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Stefan Metzmacher [Fri, 19 Jun 2015 20:23:01 +0000 (22:23 +0200)]
s3:include: remove used unused {CLIENT,SERVER}_NDR_PADDING_SIZE
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11061
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Stefan Metzmacher [Fri, 19 Jun 2015 20:09:57 +0000 (22:09 +0200)]
s3:rpc_server: remove pad handling from api_pipe_alter_context()
This is not needed and windows doesn't use it.
The padding is for the payload in request and response.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11061
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Stefan Metzmacher [Fri, 19 Jun 2015 13:52:11 +0000 (15:52 +0200)]
s3:librpc/rpc: fix padding calculation in dcerpc_guess_sizes()
The padding needs to be relative to the payload start not to the pdu start.
We also need align the padding to DCERPC_AUTH_PAD_ALIGNMENT (16 bytes).
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11061
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Stefan Metzmacher [Fri, 19 Jun 2015 14:55:39 +0000 (16:55 +0200)]
s3:librpc/rpc: allow up to DCERPC_AUTH_PAD_ALIGNMENT padding bytes in dcerpc_add_auth_footer()
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11061
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Stefan Metzmacher [Sat, 20 Jun 2015 15:43:47 +0000 (17:43 +0200)]
librpc/rpc: add DCERPC_AUTH_PAD_LENGTH(stub_length) helper macro
This calculates the required padding DCERPC_AUTH_PAD_ALIGNMENT
and the stub_length.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11061
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Stefan Metzmacher [Fri, 19 Jun 2015 14:48:48 +0000 (16:48 +0200)]
dcerpc.idl: add DCERPC_AUTH_PAD_ALIGNMENT (=16)
Windows pads the payload aligned to 16 bytes.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11061
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Stefan Metzmacher [Sat, 20 Jun 2015 14:19:31 +0000 (16:19 +0200)]
auth/gensec: make sure gensec_start_mech_by_authtype() resets SIGN/SEAL before starting
We want to set GENSEC_FEATURE_SIGN and GENSEC_FEATURE_SEAL based on the given
auth_level and should not have GENSEC_FEATURE_SEAL if
DCERPC_AUTH_LEVEL_INTEGRITY is desired.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11061
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Stefan Metzmacher [Fri, 19 Jun 2015 12:46:53 +0000 (14:46 +0200)]
auth/gensec: gensec_[un]seal_packet() should only work with GENSEC_FEATURE_DCE_STYLE
gensec_sig_size() also requires GENSEC_FEATURE_DCE_STYLE if
GENSEC_FEATURE_SEAL is negotiated.
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Stefan Metzmacher [Mon, 22 Jun 2015 13:17:33 +0000 (15:17 +0200)]
auth/credentials: use HAVE_GSS_KRB5_CRED_NO_CI_FLAGS_X instead of SAMBA4_USES_HEIMDAL
Newer MIT versions also have this.
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
Stefan Metzmacher [Mon, 22 Jun 2015 13:17:10 +0000 (15:17 +0200)]
s4:heimdal_build: define HAVE_GSS_KRB5_CRED_NO_CI_FLAGS_X
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
Ralph Boehme [Wed, 10 Jun 2015 13:30:04 +0000 (15:30 +0200)]
s4:torture:vfs_fruit: copyfile
Bug: https://bugzilla.samba.org/show_bug.cgi?id=11317
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Tue Jun 23 14:37:05 CEST 2015 on sn-devel-104
Ralph Boehme [Wed, 22 Apr 2015 20:29:16 +0000 (22:29 +0200)]
vfs:fruit: implement copyfile style copy_chunk
Implement Apple's special copy_chunk ioctl that requests a copy of the
whole file along with all attached metadata.
These copy_chunk requests have a chunk count of 0 that we translate to a
copy_chunk_send VFS call overloading the parameters src_off = dest_off =
num = 0.
Bug: https://bugzilla.samba.org/show_bug.cgi?id=11317
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Ralph Boehme [Wed, 22 Apr 2015 20:29:16 +0000 (22:29 +0200)]
smb2:ioctl: support for OS X AAPL copyfile style copy_chunk
Apple's special copy_chunk ioctl that requests a copy of the whole file
along with all attached metadata.
These copy_chunk requests have a chunk count of 0 that we translate to a
copy_chunk_send VFS call overloading the parameters src_off = dest_off =
num = 0.
Bug: https://bugzilla.samba.org/show_bug.cgi?id=11317
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Ralph Boehme [Mon, 27 Apr 2015 10:16:16 +0000 (12:16 +0200)]
s3:util: use pread/pwrite in transfer_file
read/write aren't overloaded in the streams VFS modules, using
pread/pwrite instead this makes it possible to use transfer_file() with
named streams.
Bug: https://bugzilla.samba.org/show_bug.cgi?id=11317
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Ralph Boehme [Tue, 9 Jun 2015 15:47:31 +0000 (17:47 +0200)]
smbd/smb2_ioctl: fix error handling
tevent_req_nterror must be called directly as the last step before
returning with tevent_req_post.
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Ralph Boehme [Mon, 15 Jun 2015 16:31:23 +0000 (18:31 +0200)]
vfs_fruit: simplify lp_parm_bool check
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Felix Janda [Sun, 21 Jun 2015 10:03:56 +0000 (12:03 +0200)]
replace: Replace BSD strtoll by wrapping strtoll instead of strtoq
When it is detected that strtoll returns EINVAL not only in the case
that the base is not supported, HAVE_BSD_STRTOLL is declared and
strtoll is replaced. The current replacement code wraps strtoq in
order to replace strtoll and errors out when strtoq is missing.
In order to remove this possible error path, we can use strtoll instead
of strtoq since the code is only used when it is known that strtoll exists.
The fixes a compilation problem on linux systems using musl libc, which
has a BSD-like strtoll but no strtoq.
Signed-off-by: Felix Janda <felix.janda@posteo.de>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: "Stefan (metze) Metzmacher" <metze@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Mon Jun 22 12:49:10 CEST 2015 on sn-devel-104
Anoop C S [Fri, 19 Jun 2015 06:23:23 +0000 (11:53 +0530)]
lib/sysquota_linux: Handle the quota flags properly
sys_set_vfs_quota() expects the quota flags i.e, qflags
to be updated in the dp structure for which the routines
sys_get_linux_gen_quota(), sys_get_linux_v2_quota() and
sys_get_linux_v1_quota() failed to do so in their
respective definitions. Th error was uncovered by
compiler warnings [-Wunused-but-set-variable] displayed
for qflags variables in the above mentioned functions
and this patch fixes the same.
Signed-off-by: Anoop C S <achiraya@redhat.com>
Reviewed-by: Jose A. Rivera <jarrpa@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
Autobuild-User(master): Michael Adam <obnox@samba.org>
Autobuild-Date(master): Sat Jun 20 03:11:19 CEST 2015 on sn-devel-104
Volker Lendecke [Sat, 14 Feb 2015 15:30:33 +0000 (16:30 +0100)]
rpc: Simplify dcerpc_binding_handle_raw_call()
Align it with dcerpc_binding_handle_call()
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jose A. Rivera <jarrpa@samba.org>
Autobuild-User(master): José A. Rivera <jarrpa@samba.org>
Autobuild-Date(master): Fri Jun 19 20:17:24 CEST 2015 on sn-devel-104
Andreas Schneider [Fri, 19 Jun 2015 07:28:32 +0000 (09:28 +0200)]
wafsamba: Also build libraries with RELRO protection
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11346
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Fri Jun 19 12:51:48 CEST 2015 on sn-devel-104
Volker Lendecke [Fri, 12 Jun 2015 09:03:21 +0000 (09:03 +0000)]
Fix a typo
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ira Cooper <ira@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Fri Jun 19 01:05:17 CEST 2015 on sn-devel-104
Jeremy Allison [Thu, 18 Jun 2015 17:21:07 +0000 (10:21 -0700)]
s3: smbd: Codenomicon crash in do_smb_load_module().
Inside api_pipe_bind_req() we look for a pipe module name using
dcerpc_default_transport_endpoint(pkt,
NCACN_NP, table)
which returns NULL when given invalid pkt data from the Codenomicon fuzzer.
This gets passed directly to smb_probe_module(), which then calls
do_smb_load_module() which tries to deref the (NULL) module name.
https://bugzilla.samba.org/show_bug.cgi?id=11342
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ira Cooper <ira@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Jun 18 22:14:01 CEST 2015 on sn-devel-104
Jeremy Allison [Thu, 18 Jun 2015 16:57:42 +0000 (09:57 -0700)]
dcerpc: NULL pointer deref crash in handling rpc request.
source4/rpc_server/dcerpc_server.c:dcesrv_request() calls gensec_have_feature().
Codenomicon found a code path that allows the client to send a
request that calls into this function without ever having set
up security. So call->conn->auth_state.gensec_security exists
(gensec has been initialized when the RPC pipe is set up)
but call->conn->auth_state.gensec_security->ops has not been
initialized. We dereference the NULL pointer and crash.
An alternate way to fix this would be to create a new
public bool gensec_initialized(() function and call that
inside dcesrv_request() instead of doing a null
check on call->conn->auth_state.gensec_security,
but that's a more invasive fix we can add later.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11341
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
Christof Schmitt [Fri, 12 Jun 2015 20:52:37 +0000 (13:52 -0700)]
selftest: Add blackbox test for srvsvc calls from rpcclient
Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Thu Jun 18 19:18:31 CEST 2015 on sn-devel-104
Christof Schmitt [Fri, 12 Jun 2015 15:37:30 +0000 (08:37 -0700)]
selftest: Add callout scripts for RPC SRVSVC share modifications
Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Rowland Penny [Fri, 5 Jun 2015 18:31:38 +0000 (19:31 +0100)]
samba-tool: make 'samba-tool fsmo *' aware of all 7 fsmo roles
BUG: https://bugzilla.samba.org/show_bug.cgi?id=10734
Signed-off-by: Rowland Penny <repenny241155@gmail.com>
Reviewed-by: Jelmer Vernooij <jelmer@samba.org>
Reviewed-by: Jose A. Rivera <jarrpa@samba.org>
Autobuild-User(master): José A. Rivera <jarrpa@samba.org>
Autobuild-Date(master): Thu Jun 18 10:24:48 CEST 2015 on sn-devel-104
Jeremy Allison [Wed, 17 Jun 2015 22:50:31 +0000 (15:50 -0700)]
s3: smbd - Fix SMB3.11 protocol encryption selection.
Selecting encryption in 3.11 depends on the negprot contexts being present.
Setting SMB2_CAP_ENCRYPTION from the 3.11 client is optional. The absence
of it should not remove the negprot context.
Found by the Microsoft testsuites at the Redmond plugfest.
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Steve French <sfrench@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Jun 18 04:09:04 CEST 2015 on sn-devel-104
Andrew Bartlett [Tue, 16 Jun 2015 23:59:49 +0000 (11:59 +1200)]
selftest: Change chgdcpass environment to use winbindd
This allows us to test that winbindd starts up without secrets.tdb, as happens after
a classicupgrade.
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Jun 18 00:59:54 CEST 2015 on sn-devel-104
Andrew Bartlett [Thu, 11 Jun 2015 23:57:07 +0000 (11:57 +1200)]
winbindd: Sync secrets.ldb into secrets.tdb on startup
This ensures that the domain SID and machine account password are written into
secrets.tdb if the secrets.tdb file was either never written or was deleted.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=10991
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Andrew Bartlett [Thu, 11 Jun 2015 23:54:21 +0000 (11:54 +1200)]
winbindd: Use pdb_get_domain_info() to get exactly the local domain info when we are an AD DC
This also triggers pdb_samba_dsdb_init_secrets(), to force the
correct SID into secrets.tdb.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=10991
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Andrew Bartlett [Tue, 16 Jun 2015 23:10:15 +0000 (11:10 +1200)]
selftest: Run winbind tests in chgdcpass environment
This ensures that winbind both starts and operates without a secrets.tdb
(chgdcpass deliberatly removes the secrets.tdb file after provision, like has happend with classicupgrade).
Andrew Bartlett
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Tue, 16 Jun 2015 22:50:30 +0000 (15:50 -0700)]
smbd: Fix clients connecting unencrypted with PROTOCOL_SMB2_24 or higher.
Nonce code was terminating connections where xconn->smb2.server.cipher == 0.
If no negotiated cipher (smb2.server.cipher is zero) set nonce_high_max to zero.
smb2_get_new_nonce() returns NT_STATUS_ENCRYPTION_FAILED if it is ever called with
session->nonce_high_max == 0.
Bug: https://bugzilla.samba.org/show_bug.cgi?id=11300
Signed-off-by: Jeremy Allison <jra@samba.org>
Stefan Metzmacher [Mon, 15 Jun 2015 06:34:12 +0000 (08:34 +0200)]
s3:smb2_setinfo: fix memory leak in the defer_rename case
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11329
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Christof Schmitt [Tue, 9 Jun 2015 17:29:21 +0000 (10:29 -0700)]
docs-xml: Update sharesec manpage to reflect current output
Update the sharesec man page to reflect the output currently used, and
also add a note that the OWNER and GROUP fields are not used for share
ACLs.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11324
Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Wed Jun 17 13:36:23 CEST 2015 on sn-devel-104
Christof Schmitt [Tue, 9 Jun 2015 17:28:17 +0000 (10:28 -0700)]
selftest: Add test for sharesec command
Add a test for the sharesec command to ensure that it works, and to also
verify that the output does not change.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11324
Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Christof Schmitt [Tue, 9 Jun 2015 16:50:18 +0000 (09:50 -0700)]
sharesec: Use non-numerical output for sharesec
This is an easy change to get the sharesec output back to the format
used before. It is also easier to understand than the output of the
flags.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11324
Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Uri Simchoni [Mon, 15 Jun 2015 19:33:28 +0000 (22:33 +0300)]
heimdal: fix endless loop for specific KDC error code
When sending a Kerberos request, if at least one of the available
KDCs repeatedly replies with an error response of
KRB5KDC_ERR_SVC_UNAVAILABLE, and all other KDCs, if there are any,
do not reply at all or cannot be contacted, then the code repeatedly
retries to send the request in an endless loop.
This is fixed in upstream (post 1.5 branch) heimdal but the code
there is vastly refactored, so this is an independent fix to the issue.
Signed-off-by: Uri Simchoni <urisimchoni@gmail.com>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Wed Jun 17 02:34:31 CEST 2015 on sn-devel-104
Volker Lendecke [Tue, 16 Jun 2015 06:20:56 +0000 (06:20 +0000)]
lib: Fix CID
1306765 Unchecked return value from library
This one might be a bit controversial. I don't see from man fcntl how this
could fail. But if it does, we definitely do want to know about it. And here we
don't have any good way to tell our caller, so abort.
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: "Stefan (metze) Metzmacher" <metze@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Tue Jun 16 19:22:52 CEST 2015 on sn-devel-104
Volker Lendecke [Tue, 16 Jun 2015 06:12:47 +0000 (06:12 +0000)]
lib: Fix CID
1306764 Unchecked return value
tevent_req_oom exists right for this case :-)
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: "Stefan (metze) Metzmacher" <metze@samba.org>
git.samba.org / sfrench / samba-autobuild / .git / log