Amitay Isaacs [Tue, 5 Nov 2019 05:56:10 +0000 (16:56 +1100)]
ctdb-tdaemon: Add tdaemon library for starting a daemon
Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Amitay Isaacs [Thu, 29 Nov 2018 02:57:28 +0000 (13:57 +1100)]
ctdb-tdaemon: Template daemon functions
Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Martin Schwenke [Wed, 30 Oct 2019 23:05:23 +0000 (10:05 +1100)]
ctdb-tests: Add transport header test
Signed-off-by: Martin Schwenke <martin@meltin.net>
Martin Schwenke [Wed, 30 Oct 2019 09:29:45 +0000 (20:29 +1100)]
ctdb-tests: Add transport packet test
Signed-off-by: Martin Schwenke <martin@meltin.net>
Amitay Isaacs [Fri, 28 Jun 2019 13:39:00 +0000 (23:39 +1000)]
ctdb-transport: Add transport api
Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Amitay Isaacs [Fri, 28 Jun 2019 13:38:24 +0000 (23:38 +1000)]
ctdb-transport: Add transport database for endpoint to pid translation
Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Amitay Isaacs [Fri, 28 Jun 2019 13:37:04 +0000 (23:37 +1000)]
ctdb-transport: Add marshalling routines for transport header
Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Amitay Isaacs [Fri, 28 Jun 2019 13:36:11 +0000 (23:36 +1000)]
ctdb-transport: Add marshalling for transport protocol
Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Amitay Isaacs [Fri, 28 Jun 2019 13:34:56 +0000 (23:34 +1000)]
ctdb-transport: Add new transport protocol
Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Amitay Isaacs [Fri, 28 Jun 2019 13:10:38 +0000 (23:10 +1000)]
ctdb-build: Add messages_dgm build to ctdb
Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Amitay Isaacs [Fri, 28 Jun 2019 13:07:34 +0000 (23:07 +1000)]
lib/util: Build genrand for util core
messages_dgm depends on genrand.
Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Amitay Isaacs [Fri, 28 Jun 2019 13:05:43 +0000 (23:05 +1000)]
lib/messaging: Move messages_dgm out of source3
... so CTDB can also use it.
Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Fabrice Fontaine [Mon, 16 Dec 2019 09:28:53 +0000 (10:28 +0100)]
source4/utils/oLschema2ldif: include stdint.h before cmocka.h
This fix the following build failure:
In file included from /home/fabrice/buildroot/output/host/opt/ext-toolchain/lib/gcc/mips64el-buildroot-linux-uclibc/5.5.0/include/stdint.h:9:0,
from /home/fabrice/buildroot/output/host/mips64el-buildroot-linux-uclibc/sysroot/usr/include/inttypes.h:27,
from ../../lib/replace/../replace/replace.h:64,
from ../../source4/include/includes.h:23,
from ../../source4/utils/oLschema2ldif/test.c:25:
/home/fabrice/buildroot/output/host/mips64el-buildroot-linux-uclibc/sysroot/usr/include/stdint.h:122:27: error: conflicting types for ‘uintptr_t’
typedef unsigned long int uintptr_t;
^
In file included from ../../source4/utils/oLschema2ldif/test.c:23:0:
/home/fabrice/buildroot/output/host/mips64el-buildroot-linux-uclibc/sysroot/usr/include/cmocka.h:132:28: note: previous declaration of ‘uintptr_t’ was here
typedef unsigned int uintptr_t;
Fixes:
- http://autobuild.buildroot.org/results/
9507739b3d5d51024ee9c60b74c2f85d5004e7e2
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14218
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Reviewed-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Wed Dec 18 16:57:52 UTC 2019 on sn-devel-184
Fabrice Fontaine [Sun, 15 Dec 2019 16:08:24 +0000 (17:08 +0100)]
lib/ldb/tests: include stdint.h before cmocka.h
This fix the following build failures:
[2466/3864] Linking bin/default/lib/ldb/ldbmodify
In file included from /home/buildroot/autobuild/instance-0/output-1/host/opt/ext-toolchain/lib/gcc/mips64el-buildroot-linux-uclibc/5.5.0/include/stdint.h:9:0,
from ../../lib/tevent/tevent.h:31,
from ../../lib/ldb/include/ldb.h:51,
from ../../lib/ldb/tests/test_ldb_dn.c:25:
/home/buildroot/autobuild/instance-0/output-1/host/mips64el-buildroot-linux-uclibc/sysroot/usr/include/stdint.h:122:27: error: conflicting types for 'uintptr_t'
typedef unsigned long int uintptr_t;
^
In file included from ../../lib/ldb/tests/test_ldb_dn.c:23:0:
/home/buildroot/autobuild/instance-0/output-1/host/mips64el-buildroot-linux-uclibc/sysroot/usr/include/cmocka.h:132:28: note: previous declaration of 'uintptr_t' was here
typedef unsigned int uintptr_t;
^
In file included from /home/buildroot/autobuild/instance-0/output-1/host/opt/ext-toolchain/lib/gcc/mips64el-buildroot-linux-uclibc/5.5.0/include/stdint.h:9:0,
from ../../lib/tevent/tevent.h:31,
from ../../lib/ldb/tests/ldb_key_value_test.c:48:
/home/buildroot/autobuild/instance-0/output-1/host/mips64el-buildroot-linux-uclibc/sysroot/usr/include/stdint.h:122:27: error: conflicting types for 'uintptr_t'
typedef unsigned long int uintptr_t;
^
In file included from ../../lib/ldb/tests/ldb_key_value_test.c:43:0:
/home/buildroot/autobuild/instance-0/output-1/host/mips64el-buildroot-linux-uclibc/sysroot/usr/include/cmocka.h:132:28: note: previous declaration of 'uintptr_t' was here
typedef unsigned int uintptr_t;
^
Fixes:
- http://autobuild.buildroot.org/results/
9507739b3d5d51024ee9c60b74c2f85d5004e7e2
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14218
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Reviewed-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Torsten Fohrer [Sun, 15 Dec 2019 15:58:40 +0000 (16:58 +0100)]
Avoiding bad call flags with python 3.8, using METH_NOARGS instead of zero.
(C) SBE network solutions GmbH
Signed-off-by: Torsten Fohrer <torsten.fohrer@sbe.de>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Wed Dec 18 14:33:58 UTC 2019 on sn-devel-184
Björn Baumbach [Tue, 13 Aug 2019 11:15:58 +0000 (13:15 +0200)]
samba_kcc: avoid ValueError when local connections are less than 2
Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Autobuild-User(master): Björn Baumbach <bb@sernet.de>
Autobuild-Date(master): Wed Dec 18 11:37:53 UTC 2019 on sn-devel-184
Ralph Boehme [Sat, 14 Dec 2019 17:35:51 +0000 (18:35 +0100)]
lib/replace: prefer <sys/xattr.h> over <attr/xattr.h>
This prevents the following compile error that may happens if "system/filesys.h"
is included before "system/capability.h" on Ubuntu 16.04:
[1802/4407] Compiling source3/lib/system.c
In file included from ../../lib/replace/system/filesys.h:112:0,
from ../../source3/include/vfs.h:29,
from ../../source3/include/smb.h:150,
from ../../source3/include/includes.h:284,
from ../../source3/lib/system.c:23:
/usr/include/x86_64-linux-gnu/sys/xattr.h:32:3: error: expected identifier before numeric constant
XATTR_CREATE = 1, /* set value, fail if attr already exists. */
^
The above error is from compiling a source tree which includes a change that
adds an include "system/filesys.h" to the top of "source3/include/vfs.h".
"source3/lib/system.c" has the following includes:
#include "includes.h"
#include "system/syslog.h"
#include "system/capability.h"
#include "system/passwd.h"
#include "system/filesys.h"
#include "../lib/util/setid.h"
The first include of "includes.h" pulls in "vfs.h" which will pull in
"system/filesys.h" with the mentioned change. "system/filesys.h" pulls in
<attr/xattr.h> which has this define
#define XATTR_CREATE 0x1
Later in "source3/lib/system.c" "system/capability.h" is included which includes
<sys/xattr.h> on Ubuntu 16.04 (not in later versions of glibc). This defines the
XATTR_* values as an enum:
enum {
XATTR_CREATE = 1, /* set value, fail if attr already exists. */
XATTR_REPLACE = 2 /* set value, fail if attr does not exist. */
};
The previous define of XATTR_CREATE as 1 makes this
enum {
1 = 1, /* set value, fail if attr already exists. */
2 = 2 /* set value, fail if attr does not exist. */
};
which is invalid C. The compiler error diagnostic is a bit confusing, as it
prints the original enum from the include file.
See also:
<https://bugs.freedesktop.org/show_bug.cgi?id=78741>
<https://bugs.launchpad.net/ubuntu/+source/attr/+bug/
1288091>
<https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=756097>
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Björn Baumbach <bb@samba.org>
Andrew Bartlett [Fri, 13 Dec 2019 02:56:55 +0000 (15:56 +1300)]
librpc: Move winstation.idl to the top level and exclude from fuzzing
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Dec 18 08:05:05 UTC 2019 on sn-devel-184
Andrew Bartlett [Fri, 13 Dec 2019 02:34:34 +0000 (15:34 +1300)]
lib/fuzzing and librpc: Do not generate fuzzers for pointless targets
We need to focus the fuzzing effort on reachable code, and these IDL
are just historical artifacts, many are entirely [todo] and have
no samba client nor server.
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Andrew Bartlett [Fri, 13 Dec 2019 01:48:38 +0000 (14:48 +1300)]
lib/fuzzer: Allow coverage build for oss-fuzz
This still does not seem to be enough but it is one step towards a working
coverage build.
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Gary Lockyer [Tue, 17 Dec 2019 22:17:51 +0000 (11:17 +1300)]
lib ldb: fix use after free
Fix ASAN detected use after free. No security implications as the
talloc_free is followed immediately by the print statement and the value
printed is an integer
Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Andrew Bartlett [Thu, 12 Dec 2019 23:19:37 +0000 (12:19 +1300)]
librpc: Fix manually written printer for drsuapi_DsAttributeValue
Credit to OSS-Fuzz
Found using the ndr_fuzz_X target.
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Andrew Bartlett [Thu, 12 Dec 2019 23:20:35 +0000 (12:20 +1300)]
sefltest: Demonstrate crash in manually written printer for drsuapi_DsAttributeValue
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Andrew Bartlett [Thu, 12 Dec 2019 23:01:01 +0000 (12:01 +1300)]
lib/fuzzing: Allow load of fuzz inputs as files on the command line
This is easier to put under gdb.
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Andrew Bartlett [Fri, 13 Dec 2019 09:41:10 +0000 (22:41 +1300)]
lib/fuzzing: Initialise st buffer in fuzz_ndr_X
An NDR pull of a function will fill in either the in. or out.
elements of this structure, but never both.
However, some structures have size_is() in the out. that reference
the in. elements. This is the reason for the --context-file option
in ndrdump.
We have a special handler in the fuzzing case embedded in the
pidl-generated output to cope with this, by filling in pointers
for elements declared [ref,in] but it relies on the in-side
(at least) of the buffer being zeroed.
So zero the buffer before we start. Sadly this means things
like valgrind can not find a use of uninitialised data, but that
is a price we have to pay.
Credit to OSS-Fuzz
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Volker Lendecke [Wed, 11 Dec 2019 15:19:59 +0000 (16:19 +0100)]
smbd: Convert share_mode_data->num_share_modes into a boolean8
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Wed Dec 18 00:05:13 UTC 2019 on sn-devel-184
Volker Lendecke [Wed, 11 Dec 2019 09:02:54 +0000 (10:02 +0100)]
smbd: Don't store "num_share_modes" in locking.tdb
With the last commit we don't store the share mode entry count
anymore. With this commit we go one step further and avoid storing
it. If there's valid record in locking.tdb, there is a corresponding
record in share_entries.tdb, so there's no point storing that once
more explicitly.
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Volker Lendecke [Tue, 10 Dec 2019 17:15:40 +0000 (18:15 +0100)]
smbd: Use share_mode_data->num_share_modes as a boolean
This is a micro-commit showing that we don't actually need
share_mode_data->num_share_modes as a number *counting* the share mode
entries in share_entries.tdb anymore. Instead, we are only using it as
an indication for share_mode_lock_destructor() to see whether share
entries are around or not, i.e. whether it's worth keeping or deleting
the record in locking.tdb.
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Volker Lendecke [Tue, 17 Dec 2019 13:23:16 +0000 (14:23 +0100)]
smbd: Avoid a direct access to share_mode_data->num_share_modes
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Volker Lendecke [Tue, 17 Dec 2019 13:20:48 +0000 (14:20 +0100)]
smbd: Introduce share_mode_have_entries()
This hides a use of share_mode_data->num_share_modes in
share_mode_lock.c
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Volker Lendecke [Tue, 10 Dec 2019 13:41:57 +0000 (14:41 +0100)]
smbd: Avoid a reference to share_mode_data->num_share_modes
share_mode_data->num_share_modes will go away soon, count the values
directly while walking the array.
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Volker Lendecke [Tue, 3 Dec 2019 09:39:12 +0000 (10:39 +0100)]
smbd: Avoid a reference to share_mode_data->num_share_modes
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Volker Lendecke [Tue, 3 Dec 2019 09:36:21 +0000 (10:36 +0100)]
smbd: Pass num_share_modes to share_mode_entry_do() callback
mark_share_mode_disconnected_fn() will need this, the information is
easily available and should not hurt the other callers.
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Volker Lendecke [Fri, 29 Nov 2019 14:46:20 +0000 (15:46 +0100)]
net: Use share_mode_count_entries()
Avoid a reference to share_mode_data->num_share_modes
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Volker Lendecke [Fri, 29 Nov 2019 14:45:22 +0000 (15:45 +0100)]
smbd: Add share_mode_count_entries()
In order to not write the share mode on every open/close, we need to get rid of
share_mode_data->num_share_modes. "net tdb" needs this information precisely
though, and it's pretty cheap to calculate.
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
David Disseldorp [Thu, 12 Dec 2019 21:14:50 +0000 (22:14 +0100)]
vfs_ceph_snapshots: fix root relative path handling
For file paths relative to root, ceph_snap_get_parent_path() may return
an empty parent dir string, in which case the CephFS snashot path should
be ".snap".
Bug: https://bugzilla.samba.org/show_bug.cgi?id=14216
Signed-off-by: David Disseldorp <ddiss@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Anoop C S [Tue, 12 Nov 2019 14:28:43 +0000 (19:58 +0530)]
s3: VFS: glusterfs: Reset nlinks for symlink entries during readdir
On receiving an already initialized stat_ex buffer for readdir() call we
invoke readdirplus() GlusterFS API, an optimized variant of readdir(),
which then returns stat information along with dir entry result. But for
symlink entries we don't know if link or target info is needed. In that
case it is better to leave this decision back to caller by resetting
nlinks value inside stat information to make it invalid.
This was also preventing us from displaying msdfs link as directories
inside the share.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14182
Signed-off-by: Anoop C S <anoopcs@redhat.com>
Reviewed-by: Günther Deschner <gd@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Dec 17 21:53:07 UTC 2019 on sn-devel-184
Simo Sorce [Mon, 16 Dec 2019 21:23:41 +0000 (16:23 -0500)]
mit-kdb: Fix license on header file
Signed-off-by: Simo Sorce <idra@samba.org>
Signed-off-by: Andreas Schneider <asn@samba.org>
Signed-off-by: Alexander Bokovoy <ab@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Tue Dec 17 09:24:56 UTC 2019 on sn-devel-184
Günther Deschner [Fri, 26 Aug 2016 13:39:56 +0000 (15:39 +0200)]
s3-rpc_server: always print the full PDU.
Guenther
Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Volker Lendecke [Fri, 13 Dec 2019 13:40:03 +0000 (14:40 +0100)]
smbd: Use explicit share_mode_wakeup_waiters()
We don't need to unparse the locking.tdb record, we just need to wake
up waiters when removing an oplock
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Mon Dec 16 20:27:59 UTC 2019 on sn-devel-184
Volker Lendecke [Fri, 13 Dec 2019 13:40:03 +0000 (14:40 +0100)]
smbd: Use explicit share_mode_wakeup_waiters()
We don't need to unparse the locking.tdb record, we just need to wake
up waiters when downgrading a lease
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Volker Lendecke [Tue, 10 Dec 2019 17:55:39 +0000 (18:55 +0100)]
smbd: Explicitly state when modifying share_mode_data
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Volker Lendecke [Fri, 13 Dec 2019 15:31:35 +0000 (16:31 +0100)]
torture4: Fix a typo
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Volker Lendecke [Fri, 13 Dec 2019 15:06:43 +0000 (16:06 +0100)]
smbd: Fix a typo
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Volker Lendecke [Fri, 13 Dec 2019 15:05:05 +0000 (16:05 +0100)]
smbd: Avoid casts in open_directory()
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Fri, 13 Dec 2019 19:48:05 +0000 (11:48 -0800)]
s3: smbd: msdfs: Factor out the code to create a msdfs:referral,list into a separate function.
This will allow it to be called from other places once the get/set_msdfs
calls are moved into being first class VFS functions.
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Mon Dec 16 15:32:08 UTC 2019 on sn-devel-184
Jeremy Allison [Fri, 13 Dec 2019 17:52:31 +0000 (09:52 -0800)]
s3: smbd: cleanup. Change 'int referral_count' -> 'size_t referral_count' in struct junction_map.
This is a non-negative count. Fix remaing code to not mix int and size_t.
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Jeremy Allison [Fri, 13 Dec 2019 17:39:55 +0000 (09:39 -0800)]
s3: smbd: msdfs: Cleanup, don't mix int and size_t types for a count variable.
Add integer wrap check.
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Ralph Boehme [Thu, 12 Dec 2019 09:46:21 +0000 (10:46 +0100)]
lib/replace: work around an API conflict between ncurses and XFS xattr API
Compile error:
[4530/4693] Compiling source3/utils/regedit_list.c
In file included from ../../source3/utils/regedit_list.h:24,
from ../../source3/utils/regedit_list.c:20:
/usr/include/curses.h:611:28: error: conflicting types for ‘attr_get’
611 | extern NCURSES_EXPORT(int) attr_get (attr_t *, NCURSES_PAIRS_T *, void *); /* generated */
| ^~~~~~~~
compilation terminated due to -Wfatal-errors.
Both ncurses and XFS xattr API provide a get_attr() function. As a workaround
avoid including <sys|attr/attributes.h> if <attr|sys/xattr.h> is present.
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Dec 12 20:22:51 UTC 2019 on sn-devel-184
Andrew Bartlett [Tue, 3 Dec 2019 23:45:42 +0000 (12:45 +1300)]
libndr: Return enum ndr_err_code from ndr_{pull,push}_steal_switch_value()
This breaks the ABI so we merge this into the unreleased libndr-1.0.0.
The advantage of the new functions is there (except for print, which
is unchanged) is an error raised when the token is not found, so
we can be confident in the changes to the token behaviour.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13876
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Thu Dec 12 03:56:23 UTC 2019 on sn-devel-184
Andrew Bartlett [Wed, 27 Nov 2019 02:20:32 +0000 (15:20 +1300)]
librpc/ndr: Remove ndr_{push,pull}_get_switch_value()
By removing this we know we do not need to worry about this list
growing without bounds. We merge this into the recently created but
not yet released ABI 1.0.0
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13876
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Andrew Bartlett [Wed, 27 Nov 2019 03:36:04 +0000 (16:36 +1300)]
librpc: Remove last callers of ndr_push_get_switch_value()
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13876
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Andrew Bartlett [Tue, 26 Nov 2019 05:35:36 +0000 (18:35 +1300)]
librpc: Remove last callers of ndr_pull_get_switch_value()
By removing this we know we do not need to worry about this list
growing without bounds.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13876
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Andrew Bartlett [Tue, 19 Nov 2019 04:38:50 +0000 (17:38 +1300)]
librpc: Do not follow a NULL pointer when calculating the size of a union
Found by Douglas Bagnall using Hongfuzz and the new fuzz_ndr_X
fuzzer.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13876
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Andrew Bartlett [Fri, 15 Nov 2019 07:04:41 +0000 (20:04 +1300)]
pidl: Mismatch between set and get of relative base pointers
The set was within the switch, the get was before the switch.
The difference is shown when there is an empty default element.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13876
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Andrew Bartlett [Tue, 19 Nov 2019 03:58:57 +0000 (16:58 +1300)]
librpc: Do not follow a NULL pointer when calculating the size of a structure
Found by Douglas Bagnall using Hongfuzz and the new fuzz_ndr_X
fuzzer.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13876
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Andrew Bartlett [Fri, 15 Nov 2019 07:04:41 +0000 (20:04 +1300)]
pidl: Mismatch between set and get of relative base pointers
The set was within the switch, the get was before the switch.
The difference is shown when there is an empty default element.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13876
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Andrew Bartlett [Sun, 17 Nov 2019 23:02:03 +0000 (12:02 +1300)]
pidl: Add and use ndr_print_steal_switch_value(), removing ndr_print_get_switch_value()
This avoids really long token lists for switch values
that will not be needed past this point.
The function name is changed to clarify what exactly is being
done here, and the old function is removed to ensure it is
not being used anywhere else.
Merge the removal of ndr_print_get_switch_value into
just-tagged librpc/ABI/ndr-1.0.0.sigs as this
has not been put into any release yet.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13876
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Andrew Bartlett [Wed, 27 Nov 2019 03:01:02 +0000 (16:01 +1300)]
librpc/ndr: Add ndr_push_steal_switch_value()
This will allow generated code to instead push and pop union values onto the
switch_list stack, which is more memory efficient than creating a single large
list to be scannned and eventually discarded.
Merge into unreleased ABI 1.0.0
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13876
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Andrew Bartlett [Fri, 15 Nov 2019 03:59:12 +0000 (16:59 +1300)]
pidl: Generate and consume the switch level token for both NDR_SCALARS and NDR_BUFFERS in ndr_pull()
This means what was previously a list becomes a single variable that
could be passed as a function paraemter, but this is avoided for now
because it would change the ABI and be more intrusive.
Before this, a client could cause a NDR token containing the swith level
to be allocated for each and every element in the array that they
promised they were sending (without having to actually send them).
Found by Michael Hanselmann using Honggfuzz and an fuzzer for Samba's
NDR layer.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13876
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Andrew Bartlett [Wed, 4 Dec 2019 02:30:55 +0000 (15:30 +1300)]
librpc: Set the switch_value before NDR_BUFFERS to prepare for new libndr behaviour
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13876
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Andrew Bartlett [Sun, 17 Nov 2019 06:32:50 +0000 (19:32 +1300)]
negoex: Set the switch_value before NDR_BUFFERS to prepare for new libndr behaviour
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13876
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Andrew Bartlett [Fri, 15 Nov 2019 20:37:30 +0000 (09:37 +1300)]
s4-libcli/rap: Set the switch_value before NDR_BUFFERS to prepare for new libndr behaviour
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13876
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Andrew Bartlett [Fri, 15 Nov 2019 18:59:58 +0000 (07:59 +1300)]
ndr: Restrict size of ndr_token lists to avoid memory abuse by malicious clients
This is designed to stop a very large number of tokens from being stored for
arrays of structures containing relative pointers in particular.
This was one part of the minimum patch for CVE-2019-14908 before
being downgraded as not a security-release worthy issue.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13876
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Andrew Bartlett [Sun, 17 Nov 2019 21:38:01 +0000 (10:38 +1300)]
libndr: Do not overwrite token list with NULL on allocation failure
This was one part of the minimum patch for CVE-2019-14908 before
being downgraded as not a security-release worthy issue.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13876
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Andrew Bartlett [Wed, 4 Dec 2019 03:56:44 +0000 (16:56 +1300)]
selftest: Add test for ndr_size_struct() faulting on a NULL pointer
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13876
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Andrew Bartlett [Wed, 4 Dec 2019 03:49:13 +0000 (16:49 +1300)]
selftest: Add test for ndr_size_union() faulting on a NULL pointer
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13876
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Andrew Bartlett [Wed, 4 Dec 2019 03:02:31 +0000 (16:02 +1300)]
selftest: Add example xattr_NTACL packets to demonstrate switch/union behaviour
This is a good example with both buffers and scalars in the union.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13876
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Andrew Bartlett [Wed, 4 Dec 2019 01:46:32 +0000 (14:46 +1300)]
selftest: Add test for structure with NDR_BUFFERS only in a union
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13876
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Samuel Cabrero [Thu, 7 Mar 2019 10:35:07 +0000 (11:35 +0100)]
selftest: Do not force the endpoint for fsrvp tests
The test suite will bind to the srvsvc interface, let it find the
correct endpoint through the endpoint mapper.
Signed-off-by: Samuel Cabrero <scabrero@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Thu Dec 12 02:00:19 UTC 2019 on sn-devel-184
Samuel Cabrero [Mon, 4 Nov 2019 17:39:10 +0000 (18:39 +0100)]
s4:torture/rpc: Fix torture comment in mdssvc.c
Signed-off-by: Samuel Cabrero <scabrero@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Samuel Cabrero [Fri, 6 Sep 2019 13:16:01 +0000 (15:16 +0200)]
pidl:NDR/Server: Allow to define endpoint server shutdown functions
The next commits will register legacy api_struct when the endpoint server
is initialized. This commit adds a shutdown function which will be used
to unregister the legacy api_struct.
The shutdown function will be also used to replace the rpc_srv_callbacks
struct shutdown member used, for example, by the spoolss service to
cleanup before exiting.
Signed-off-by: Samuel Cabrero <scabrero@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Samuel Cabrero [Tue, 1 Oct 2019 14:59:07 +0000 (16:59 +0200)]
librpc:core: Add a function to reinitialize the dcesrv_context
Clears all registered endpoints and interfaces, association groups and
broken connections.
To be used by S3 forked daemons.
Signed-off-by: Samuel Cabrero <scabrero@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Samuel Cabrero [Fri, 6 Sep 2019 12:38:29 +0000 (14:38 +0200)]
librpc:core: Add public functions to initialize endpoint servers
The dcesrv_init_registered_ep_servers() will be used by the S3 server to
initialize all registered endpoint servers (for embedded services), and
the dcesrv_init_ep_server() function will be used by the external
daemons to initialize the required ones.
As serveral S3 services may require to initialize another one before
itself (svcctl and eventlog for example require winreg) a boolean flag is
added to track the initialization status.
Signed-off-by: Samuel Cabrero <scabrero@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Samuel Cabrero [Tue, 5 Feb 2019 17:54:02 +0000 (18:54 +0100)]
librpc:core: Split dcesrv context init and endpoint servers init
The S4 server will initialize the endpoint servers specified in smb.conf,
but the S3 server need to initialize all registered endpoint servers (the
embedded ones).
Signed-off-by: Samuel Cabrero <scabrero@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Andrew Bartlett [Sun, 1 Dec 2019 22:20:31 +0000 (11:20 +1300)]
librpc/idl/dnsserver.idl: Ensure DnsProperty id matches what is pulled from the stored buffer
There are two concerns here, assuming the attacker can place arbitary values
in a dnsProperty attribute over LDAP (eg is a DNS administrator).
This comes from the fact that id is used as the switch value at the C layer
but at the NDR layer the wDataLength value is considered first.
One concern is that a pull/push round-trip could include server memory:
The previous switch_is() behaviour could store the server memory back
into the attribute.
However this pattern of pull/push only happens in ndrdump and fuzzing tools, as
dnsserver_db_do_reset_dword() operates only on the uint32/bitmap union
arms, and fully initialises those.
The other is that a pull of the attacker-supplied value could
cause the server to expose memory.
This would be over the network via DNS or the RPC dnsserver protocols.
However at all times the ndr_pull_struct_blob is passed zeroed memory.
The final concern (which fuzz_ndr_X found) is that in the ndr_size_dnsPropertyData()
the union descriminent is only id.
This has no impact as only zeroed memory is used so there will be a
zero value in all scalars, including data->d_ns_servers.AddrArray.
Therefore the server will not crash processing the attacker-supplied blob
[MS-DNSP] 2.3.2.1 dnsProperty has no mention of this special behaviour.
https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-dnsp/
445c7843-e4a1-4222-8c0f-
630c230a4c80
This was known as CVE-2019-14908 before being triaged back to a normal bug.
Found by Douglas Bagnall using Hongfuzz and the new fuzz_ndr_X fuzzer.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14206
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@samba.org>
Gary Lockyer [Sun, 8 Dec 2019 20:19:47 +0000 (09:19 +1300)]
librpc dnsp test: Ensure length matches union selector
Ensure that a dnsp_DnsProperty is rejected if the length data does not not
correspond to the length indicated by the union id. It was possible for
the union to be referencing memory past the end of the structure.
Found by Douglas Bagnall using Hongfuzz and the new fuzz_ndr_X fuzzer.
Bug: https://bugzilla.samba.org/show_bug.cgi?id=14206
Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Andrew Bartlett [Wed, 11 Dec 2019 18:35:55 +0000 (07:35 +1300)]
lib/krb5_wrap: Remove unused smb_krb5_get_allowed_weak_crypto()
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Isaac Boukris <iboukris@samba.org>
Autobuild-User(master): Isaac Boukris <iboukris@samba.org>
Autobuild-Date(master): Wed Dec 11 22:18:47 UTC 2019 on sn-devel-184
Andrew Bartlett [Wed, 11 Dec 2019 01:09:25 +0000 (14:09 +1300)]
lib/fuzzing: Fix argument order to ldb_filter_from_tree in fuzz_ldb_parse_tree
Found by the oss-fuzz CI tooling.
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Dec 11 04:21:28 UTC 2019 on sn-devel-184
Andrew Bartlett [Wed, 11 Dec 2019 00:03:43 +0000 (13:03 +1300)]
lib/fuzzing: Split up automatically build fuzzers into TYPE_{IN,OUT,STRUCT}
The advise is that a fuzz target should be as small as possible
so we split this up. Splitting up by function would build too
many fuzzers, but this should help a little.
See for example:
https://github.com/google/fuzzing/blob/master/docs/good-fuzz-target.md#large-apis
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@samba.org>
Andrew Bartlett [Tue, 10 Dec 2019 23:48:24 +0000 (12:48 +1300)]
lib/fuzzing: Ensure mem_ctx is freed each time fuzz_ldb_parse_tree is run
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@samba.org>
Andrew Bartlett [Wed, 4 Dec 2019 09:52:06 +0000 (22:52 +1300)]
autobuild: extend autobuild with samba-fuzz job to build the fuzzers in AFL mode using oss-fuzz scripts
This helps ensure the build_samba.sh file keeps working and the fuzzers build
(because they are excluded from the main build).
This is not in the default autobuild because it uses too much
space on sn-devel (4GB).
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@samba.org>
Andrew Bartlett [Mon, 9 Dec 2019 21:59:49 +0000 (10:59 +1300)]
autobuild.py: Avoid listing jobs twice
We use the tasks table instead, to avoid the issue shown in the previous commit.
Now we just have to keep .gitlab-ci.yml and the tasks table in sync.
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Gary Lockyer <gary@samba.org>
Andrew Bartlett [Mon, 9 Dec 2019 21:58:47 +0000 (10:58 +1300)]
autobuild.py: Add missing samba-simpleserver job
This was missed when the job was split out in
f0e8dd1a08698884209873bb84002d7b34db016c.
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Gary Lockyer <gary@samba.org>
Andrew Bartlett [Mon, 9 Dec 2019 21:47:12 +0000 (10:47 +1300)]
.gitlab-ci.yml: Align tasks with "pages" dependency to get comprehensive code coverage
These two lists can get out of skew very easily.
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Gary Lockyer <gary@samba.org>
Volker Lendecke [Tue, 10 Dec 2019 09:56:44 +0000 (10:56 +0100)]
smbd: Fix a leases.tdb record leak
If we set e->stale=true in the share_mode_forall_entries() callback,
the share entry will be removed directly. Thus further down
share_mode_forall_leases() won't find anything anymore. Only find
possibly still connected entries in the first walk, and then remove
the share_entries.tdb record straight away after the leases and
brlocks have been removed.
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Dec 10 21:57:05 UTC 2019 on sn-devel-184
Volker Lendecke [Tue, 10 Dec 2019 10:48:07 +0000 (11:48 +0100)]
torture: Run durable_v2_reconnect_delay_msec with leases
This will show a leases.tdb record leak. If you SIGSTOP the smbtorture
process while it's in the 10-second wait, you will find locking.tdb
and share_entries.tdb empty after the scavenger has cleaned up. But
there will be an entry in leases.tdb left.
I have no clue how to test this properly, or how to have a reasonably
cheap assert in smbd during normal operations. The problem is that
this leak can't really be distinguished from a "normal" leak that a
crashed smbd would leave behind. Possibly we need a background job
walking leases.tdb to clean this up properly.
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Volker Lendecke [Tue, 10 Dec 2019 10:31:22 +0000 (11:31 +0100)]
torture4: Use generate_random_u64() instead of random()
random() returns an int, which is not necessarily a uint64
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Andreas Schneider [Tue, 10 Dec 2019 17:06:29 +0000 (18:06 +0100)]
lib:crypto: Build intel aes-ni only if GnuTLS doesn't provide AES CMAC
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Tue Dec 10 20:30:57 UTC 2019 on sn-devel-184
Andreas Schneider [Tue, 10 Dec 2019 17:03:57 +0000 (18:03 +0100)]
lib:crypto: Only build AES code if we need AES CMAC
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Andreas Schneider [Tue, 10 Dec 2019 17:01:43 +0000 (18:01 +0100)]
lib:crypto: Remove our implementation of AES GCM
We require GnuTLS >= 3.4.7 which provides AES GCM.
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Andreas Schneider [Tue, 10 Dec 2019 16:52:36 +0000 (17:52 +0100)]
lib:crypto: Remove our implementation of AES CCM
We require GnuTLS >= 3.4.7 which provides AES CCM.
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Andrew Bartlett [Wed, 4 Dec 2019 22:37:05 +0000 (11:37 +1300)]
pidl:NDR/Parser: only include structs in ndr_interface_public_struct
We only have ndrdump and the fuzzers set up for structures, not BITMAPS,
ENUMS etc.
Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Tue Dec 10 17:45:46 UTC 2019 on sn-devel-184
Andrew Bartlett [Thu, 5 Dec 2019 22:00:57 +0000 (11:00 +1300)]
selftest: Confirm that ndrdump struct mode is not available for enums
These are not passed by pointer so the structure dump system does not work
for these. It is best to dump the containing structure instead.
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Isaac Boukris [Thu, 21 Nov 2019 10:12:48 +0000 (11:12 +0100)]
CVE-2019-14870: mit-kdc: enforce delegation_not_allowed flag
Signed-off-by: Isaac Boukris <iboukris@samba.org>
Autobuild-User(master): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(master): Tue Dec 10 10:44:01 UTC 2019 on sn-devel-184
Isaac Boukris [Mon, 28 Oct 2019 00:54:09 +0000 (02:54 +0200)]
CVE-2019-14870: heimdal: enforce delegation_not_allowed in S4U2Self
Signed-off-by: Isaac Boukris <iboukris@gmail.com>
Isaac Boukris [Wed, 30 Oct 2019 14:59:16 +0000 (15:59 +0100)]
CVE-2019-14870: heimdal: add S4U test for delegation_not_allowed
Signed-off-by: Isaac Boukris <iboukris@gmail.com>
Isaac Boukris [Sun, 27 Oct 2019 12:02:00 +0000 (14:02 +0200)]
samba-tool: add user-sensitive command to set not-delegated flag
Signed-off-by: Isaac Boukris <iboukris@gmail.com>
Andrew Bartlett [Tue, 29 Oct 2019 22:50:57 +0000 (11:50 +1300)]
CVE-2019-14861: Test to demonstrate the bug
This test does not fail every time, but when it does it casues a segfault which
takes out the rpc_server master process, as this hosts the dnsserver pipe.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14138
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Andrew Bartlett [Tue, 29 Oct 2019 01:15:36 +0000 (14:15 +1300)]
CVE-2019-14861: s4-rpc/dnsserver: Avoid crash in ldb_qsort() via dcesrv_DnssrvEnumRecords)
dns_name_compare() had logic to put @ and the top record in the tree being
enumerated first, but if a domain had both then this would break the
older qsort() implementation in ldb_qsort() and cause a read of memory
before the base pointer.
By removing this special case (not required as the base pointer
is already seperatly located, no matter were it is in the
returned records) the crash is avoided.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14138
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
git.samba.org / amitay / samba.git / log