]> git.ipfire.org Git - thirdparty/samba.git/log
thirdparty/samba.git
3 years agoCVE-2023-0614 s4-acl: Use ldb functions for handling inaccessible message elements
Joseph Sutton [Thu, 26 Jan 2023 19:29:33 +0000 (08:29 +1300)] 
CVE-2023-0614 s4-acl: Use ldb functions for handling inaccessible message elements

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15270

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agoCVE-2023-0614 ldb: Add functions for handling inaccessible message elements
Joseph Sutton [Thu, 26 Jan 2023 19:28:36 +0000 (08:28 +1300)] 
CVE-2023-0614 ldb: Add functions for handling inaccessible message elements

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15270

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agoCVE-2023-0614 s4-acl: Make some parameters const
Joseph Sutton [Thu, 26 Jan 2023 19:00:32 +0000 (08:00 +1300)] 
CVE-2023-0614 s4-acl: Make some parameters const

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15270

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agoCVE-2023-0614 s4:dsdb: Use talloc_get_type_abort() more consistently
Joseph Sutton [Mon, 6 Feb 2023 20:29:51 +0000 (09:29 +1300)] 
CVE-2023-0614 s4:dsdb: Use talloc_get_type_abort() more consistently

It is better to explicitly abort than to dereference a NULL pointer or
try to read data cast to the wrong type.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15270

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agoCVE-2023-0614 libcli/security: Make some parameters const
Joseph Sutton [Thu, 26 Jan 2023 18:57:27 +0000 (07:57 +1300)] 
CVE-2023-0614 libcli/security: Make some parameters const

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15270

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agoCVE-2023-0614 dsdb: Alter timeout test in large_ldap.py to be slower by matching...
Andrew Bartlett [Thu, 2 Mar 2023 21:31:40 +0000 (10:31 +1300)] 
CVE-2023-0614 dsdb: Alter timeout test in large_ldap.py to be slower by matching on large objects

This changes the slow aspect to be the object matching not the filter parsing.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15270

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
3 years agopython:join: fix reused variable name in provision func
John Mulligan [Fri, 24 Mar 2023 19:11:59 +0000 (15:11 -0400)] 
python:join: fix reused variable name in provision func

Recent updates to run adprep during the provision function re-used a
variable name that was already in use as a string. This reassignment
changed the type of the referenced object. This variable name is later
used to setup the mit krb5 kdc conf and expects the var to contain a
string. When executed with default cli options on a mit krb5 based build
samba tool fails with a traceback:
```
INFO 2023-03-23 21:22:50,399 pid:6
/usr/lib64/python3.10/site-packages/samba/provision/__init__.py #2021:
Fixing provision GUIDs
ERROR(<class 'AttributeError'>): uncaught exception - 'DomainUpdate'
object has no attribute 'upper'
  File "/usr/lib64/python3.10/site-packages/samba/netcmd/__init__.py",
line 230, in _run
    return self.run(*args, **kwargs)
  File "/usr/lib64/python3.10/site-packages/samba/netcmd/domain.py",
line 555, in run
    result = provision(self.logger,
  File
"/usr/lib64/python3.10/site-packages/samba/provision/__init__.py", line
2408, in provision
    create_kdc_conf(paths.kdcconf, realm, domain,
os.path.dirname(lp.get("log file")))
  File
"/usr/lib64/python3.10/site-packages/samba/provision/kerberos.py", line
43, in create_kdc_conf
    domain = domain.upper()
```

This change removes the re-use of the existing var name by chaining
the calls.

Fixes: 4bba26579d1
Signed-off-by: John Mulligan <jmulligan@redhat.com>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Apr  5 02:02:29 UTC 2023 on atb-devel-224

3 years agos4:kdc: Allocate claim value on values context
Joseph Sutton [Mon, 3 Apr 2023 01:07:30 +0000 (13:07 +1200)] 
s4:kdc: Allocate claim value on values context

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agotests/krb5: Add tests for constructed (authentication silo) claims
Joseph Sutton [Mon, 3 Apr 2023 01:24:12 +0000 (13:24 +1200)] 
tests/krb5: Add tests for constructed (authentication silo) claims

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agotests/krb5: Add method to create authentication silo claim
Joseph Sutton [Mon, 3 Apr 2023 02:28:58 +0000 (14:28 +1200)] 
tests/krb5: Add method to create authentication silo claim

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agotests/krb5: Add method to create an authentication silo
Joseph Sutton [Mon, 3 Apr 2023 00:54:55 +0000 (12:54 +1200)] 
tests/krb5: Add method to create an authentication silo

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agotests/krb5: Add methods to get authentication policy DNs
Joseph Sutton [Mon, 7 Mar 2022 04:40:10 +0000 (17:40 +1300)] 
tests/krb5: Add methods to get authentication policy DNs

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agotests/krb5: Check only for the canonical representation of a security descriptor
Joseph Sutton [Mon, 27 Mar 2023 18:46:23 +0000 (07:46 +1300)] 
tests/krb5: Check only for the canonical representation of a security descriptor

As of commit be1aae77b7610933b1121f207e0a4df523c2d278, Samba only
produces the canonical form of a security descriptor.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agolibrpc/ndr: Fix NULL pointer dereference
Joseph Sutton [Sun, 2 Apr 2023 22:40:02 +0000 (10:40 +1200)] 
librpc/ndr: Fix NULL pointer dereference

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15348

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agoUpdate WHATSNEW.txt
Andreas Schneider [Thu, 30 Mar 2023 11:43:26 +0000 (13:43 +0200)] 
Update WHATSNEW.txt

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agos3:utils: s3:utils: Correctly wire winbind ccache support for smbget
Andreas Schneider [Mon, 3 Apr 2023 06:14:30 +0000 (08:14 +0200)] 
s3:utils: s3:utils: Correctly wire winbind ccache support for smbget

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agos3:utils: Correctly wire NT hash support for smbget
Andreas Schneider [Fri, 31 Mar 2023 07:49:44 +0000 (09:49 +0200)] 
s3:utils: Correctly wire NT hash support for smbget

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agoauth: Add cli_credentials_is_password_nt_hash()
Andreas Schneider [Fri, 31 Mar 2023 08:44:16 +0000 (10:44 +0200)] 
auth: Add cli_credentials_is_password_nt_hash()

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agoauth: Remove trailing white spaces in credentials_ntlm.c
Andreas Schneider [Fri, 31 Mar 2023 08:43:59 +0000 (10:43 +0200)] 
auth: Remove trailing white spaces in credentials_ntlm.c

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agoauth: Remove trailing white spaces in credentials.h
Andreas Schneider [Fri, 31 Mar 2023 08:43:11 +0000 (10:43 +0200)] 
auth: Remove trailing white spaces in credentials.h

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agos3:tests: Add test with testdenied_upn@REALM.upn
Andreas Schneider [Tue, 4 Apr 2023 07:25:55 +0000 (09:25 +0200)] 
s3:tests: Add test with testdenied_upn@REALM.upn

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agos3:tests: Add a kerberos trust test for smbget
Andreas Schneider [Mon, 3 Apr 2023 06:30:06 +0000 (08:30 +0200)] 
s3:tests: Add a kerberos trust test for smbget

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agos3:tests: Add kerberos test for smbget
Andreas Schneider [Fri, 31 Mar 2023 07:46:02 +0000 (09:46 +0200)] 
s3:tests: Add kerberos test for smbget

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agos3:utils: Correctly wire Kerberos support for smbget
Andreas Schneider [Fri, 31 Mar 2023 07:32:02 +0000 (09:32 +0200)] 
s3:utils: Correctly wire Kerberos support for smbget

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agos3:tests: Add encryption test for smbget
Andreas Schneider [Fri, 31 Mar 2023 07:36:46 +0000 (09:36 +0200)] 
s3:tests: Add encryption test for smbget

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agos3:utils: Correctly wire encryption for smbget
Andreas Schneider [Fri, 31 Mar 2023 07:31:11 +0000 (09:31 +0200)] 
s3:utils: Correctly wire encryption for smbget

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agodocs-xml: Remove smbgetrc manpage
Andreas Schneider [Fri, 31 Mar 2023 06:40:38 +0000 (08:40 +0200)] 
docs-xml: Remove smbgetrc manpage

This has been removed, we have support for an authentication file.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agodocs-xml: Update smbget manpage
Andreas Schneider [Thu, 30 Mar 2023 11:48:06 +0000 (13:48 +0200)] 
docs-xml: Update smbget manpage

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agos3:utils: Use common command line parser for smbget
Andreas Schneider [Thu, 30 Mar 2023 09:19:01 +0000 (11:19 +0200)] 
s3:utils: Use common command line parser for smbget

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agos3:tests: Use long options for smbget in test_smbget.sh
Andreas Schneider [Thu, 30 Mar 2023 11:00:55 +0000 (13:00 +0200)] 
s3:tests: Use long options for smbget in test_smbget.sh

This is more descriptive and will help with the next commit.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agos3:utils: Add support for parsing domain/UPN in username for smbget
Andreas Schneider [Wed, 29 Mar 2023 06:48:12 +0000 (08:48 +0200)] 
s3:utils: Add support for parsing domain/UPN in username for smbget

The smbget utility doesn't use the common command line parser, so it
doesn't support paring of DOMAIN/user or user@realm.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15345

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agos3:utils: Always cleanup when leaving smbget main()
Andreas Schneider [Thu, 30 Mar 2023 09:14:26 +0000 (11:14 +0200)] 
s3:utils: Always cleanup when leaving smbget main()

This will not leak any memory. Also rename the bool to 'ok' for better
readability.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agos3:tests: Add smbget msdfs link test with domain and UPN
Andreas Schneider [Wed, 29 Mar 2023 07:03:11 +0000 (09:03 +0200)] 
s3:tests: Add smbget msdfs link test with domain and UPN

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15345

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agos3:tests: Add domain and UPN test for smbget
Andreas Schneider [Wed, 29 Mar 2023 06:59:09 +0000 (08:59 +0200)] 
s3:tests: Add domain and UPN test for smbget

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15345

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agos3:tests: Also clear the download area in smbget msdfs_link test
Andreas Schneider [Thu, 30 Mar 2023 08:26:40 +0000 (10:26 +0200)] 
s3:tests: Also clear the download area in smbget msdfs_link test

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15345

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agos3:selftest: Pass REALM to samba.blackbox.smbget
Andreas Schneider [Thu, 30 Mar 2023 08:06:55 +0000 (10:06 +0200)] 
s3:selftest: Pass REALM to samba.blackbox.smbget

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15345

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agos3:selftest: Move samba3.blackbox.smbget to ad_member
Andreas Schneider [Wed, 29 Mar 2023 11:08:37 +0000 (13:08 +0200)] 
s3:selftest: Move samba3.blackbox.smbget to ad_member

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15345

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agos3:selftest: Move the smbget share to the provision function
Andreas Schneider [Thu, 30 Mar 2023 08:16:35 +0000 (10:16 +0200)] 
s3:selftest: Move the smbget share to the provision function

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15345

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agolib:ldb:tests: Fix code spelling
Andreas Schneider [Mon, 3 Apr 2023 08:21:21 +0000 (10:21 +0200)] 
lib:ldb:tests: Fix code spelling

Best reviewed with: `git show --word-diff`.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Tue Apr  4 08:30:28 UTC 2023 on atb-devel-224

3 years agolib:ldb:nssldb: Fix code spelling
Andreas Schneider [Mon, 3 Apr 2023 08:17:14 +0000 (10:17 +0200)] 
lib:ldb:nssldb: Fix code spelling

Best reviewed with: `git show --word-diff`.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agolib:ldb:ldb_sqlite3: Fix code spelling
Andreas Schneider [Mon, 3 Apr 2023 08:16:26 +0000 (10:16 +0200)] 
lib:ldb:ldb_sqlite3: Fix code spelling

Best reviewed with: `git show --word-diff`.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agolib:ldb:ldb_map: Fix code spelling
Andreas Schneider [Mon, 3 Apr 2023 08:15:08 +0000 (10:15 +0200)] 
lib:ldb:ldb_map: Fix code spelling

Best reviewed with: `git show --word-diff`.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agolib:ldb:ldb_key_value: Fix code spelling
Andreas Schneider [Mon, 3 Apr 2023 08:13:18 +0000 (10:13 +0200)] 
lib:ldb:ldb_key_value: Fix code spelling

Best reviewed with: `git show --word-diff`.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agolib:ldb:include: Fix code spelling
Andreas Schneider [Mon, 3 Apr 2023 08:10:17 +0000 (10:10 +0200)] 
lib:ldb:include: Fix code spelling

Best reviewed with: `git show --word-diff`.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agolib:ldb:common: Fix code spelling
Andreas Schneider [Mon, 3 Apr 2023 08:07:39 +0000 (10:07 +0200)] 
lib:ldb:common: Fix code spelling

Best reviewed with: `git show --word-diff`.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agodocs-xml: Fix spelling in Samba-Developers-Guide
Andreas Schneider [Mon, 3 Apr 2023 08:00:27 +0000 (10:00 +0200)] 
docs-xml: Fix spelling in Samba-Developers-Guide

Best reviewed with: `git show --word-diff`.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agodocs-xml: Fix spelling in smb.conf manpage
Andreas Schneider [Mon, 3 Apr 2023 07:58:47 +0000 (09:58 +0200)] 
docs-xml: Fix spelling in smb.conf manpage

Best reviewed with: `git show --word-diff`.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agodocs-xml: Fix spelling in manpages
Andreas Schneider [Mon, 3 Apr 2023 07:56:46 +0000 (09:56 +0200)] 
docs-xml: Fix spelling in manpages

Best reviewed with: `git show --word-diff`.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agoctdb:doc: Fix code spelling
Andreas Schneider [Mon, 3 Apr 2023 07:48:38 +0000 (09:48 +0200)] 
ctdb:doc: Fix code spelling

Best reviewed with: `git show --word-diff`.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agobootstrap: Fix spelling in README.md
Andreas Schneider [Mon, 3 Apr 2023 07:45:42 +0000 (09:45 +0200)] 
bootstrap: Fix spelling in README.md

Best reviewed with: `git show --word-diff`.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agoFix spelling in README.Coding.md
Andreas Schneider [Mon, 3 Apr 2023 07:44:45 +0000 (09:44 +0200)] 
Fix spelling in README.Coding.md

Best reviewed with: `git show --word-diff`.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agosmbd: Indicate posix pathnames if SMB311 POSX cc requested
Volker Lendecke [Sun, 12 Feb 2023 11:35:28 +0000 (12:35 +0100)] 
smbd: Indicate posix pathnames if SMB311 POSX cc requested

Avoid making smb311 posix extensions a global thing. Posix clients
could request non-posix behaviour on individual create calls.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Tue Apr  4 07:04:13 UTC 2023 on atb-devel-224

3 years agolib:krb5_wrap: Fix code spelling
Andreas Schneider [Fri, 31 Mar 2023 09:14:11 +0000 (11:14 +0200)] 
lib:krb5_wrap: Fix code spelling

Best reviewed with: `git show --word-diff`.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Mon Apr  3 04:53:05 UTC 2023 on atb-devel-224

3 years agolib:fuzzing: Fix code spelling
Andreas Schneider [Fri, 31 Mar 2023 09:11:34 +0000 (11:11 +0200)] 
lib:fuzzing: Fix code spelling

Best reviewed with: `git show --word-diff`.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agolib:dbwrap: Fix code spelling
Andreas Schneider [Fri, 31 Mar 2023 09:10:03 +0000 (11:10 +0200)] 
lib:dbwrap: Fix code spelling

Best reviewed with: `git show --word-diff`.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agolib:crypto: Improve comment about weak crypto
Andreas Schneider [Fri, 31 Mar 2023 09:07:46 +0000 (11:07 +0200)] 
lib:crypto: Improve comment about weak crypto

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agolib:compression: Fix code spelling
Andreas Schneider [Fri, 31 Mar 2023 09:04:54 +0000 (11:04 +0200)] 
lib:compression: Fix code spelling

Best reviewed with: `git show --word-diff`.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agolib:cmdline: Fix code spelling
Andreas Schneider [Fri, 31 Mar 2023 09:04:22 +0000 (11:04 +0200)] 
lib:cmdline: Fix code spelling

Best reviewed with: `git show --word-diff`.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agolib:audit_logging: Fix code spelling
Andreas Schneider [Fri, 31 Mar 2023 09:03:08 +0000 (11:03 +0200)] 
lib:audit_logging: Fix code spelling

Best reviewed with: `git show --word-diff`.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agolib:addns: Fix code spelling
Andreas Schneider [Fri, 31 Mar 2023 09:01:47 +0000 (11:01 +0200)] 
lib:addns: Fix code spelling

Best reviewed with: `git show --word-diff`.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agolib:addns: Rename additionals to additional
Andreas Schneider [Fri, 31 Mar 2023 09:00:50 +0000 (11:00 +0200)] 
lib:addns: Rename additionals to additional

Fixes code spelling.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agos4:libnet: cleanup py_net_time()
Dmitry Antipov [Fri, 31 Mar 2023 05:06:44 +0000 (08:06 +0300)] 
s4:libnet: cleanup py_net_time()

Fix size of buffer passed to and always check the value returned
from strftime(), raise PyErr_NoMemory() and return NULL if zero,
or use it with PyUnicode_FromStringAndSize() (thus avoiding extra
internal call to strlen()) otherwise.

Signed-off-by: Dmitry Antipov <dantipov@cloudlinux.com>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agos3:modules: call rpcgen only if vfs_nfs4acl_xattr is enabled
David Disseldorp [Tue, 28 Mar 2023 15:00:24 +0000 (17:00 +0200)] 
s3:modules: call rpcgen only if vfs_nfs4acl_xattr is enabled

rpcgen may be missing, so wrap all of the vfs_nfs4acl_xattr associated
calls in an appropriate if bld.SAMBA3_IS_ENABLED_MODULE() check.

Signed-off-by: David Disseldorp <ddiss@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agotorture/smb2: do not use client time in delayed timestamp updates test
Amir Goldstein [Tue, 14 Mar 2023 17:57:08 +0000 (19:57 +0200)] 
torture/smb2: do not use client time in delayed timestamp updates test

Client time cannot be compared to server timestamp, because the clocks
on client and server may not be in sync.

Compare server timestamps, only to previous timestamps read from server.

Signed-off-by: Amir Goldstein <amir@ctera.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Sat Apr  1 06:23:36 UTC 2023 on atb-devel-224

3 years agolib: Fix tdb_validate() for incorrect tdb entries
Volker Lendecke [Wed, 29 Mar 2023 10:20:01 +0000 (06:20 -0400)] 
lib: Fix tdb_validate() for incorrect tdb entries

We should not overwrite the "rc=1" initialization with the tdb_check
retval. This will lead to tdb_validate_child() returning 0 even when
validate_fn() found invalid entries.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=14789
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
3 years agotorture3: Add tdb-validate test
Volker Lendecke [Wed, 29 Mar 2023 13:07:19 +0000 (09:07 -0400)] 
torture3: Add tdb-validate test

Bug: https://bugzilla.samba.org/show_bug.cgi?id=14789
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
3 years agosmbd: squash check_path_syntax() variants
Ralph Boehme [Fri, 31 Mar 2023 09:44:00 +0000 (11:44 +0200)] 
smbd: squash check_path_syntax() variants

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Fri Mar 31 21:21:57 UTC 2023 on atb-devel-224

3 years agos3: smbd: Correctly process SMB3 POSIX paths in create.
Jeremy Allison [Tue, 28 Mar 2023 20:55:49 +0000 (13:55 -0700)] 
s3: smbd: Correctly process SMB3 POSIX paths in create.

Remove knownfail for  posix path handling of case/reserved char

Signed-off-by: David Mulder <dmulder@samba.org>
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
3 years agos3: smbd: Correctly set smb2req->smb1req->posix_pathnames from the calling fsp on...
Jeremy Allison [Tue, 28 Mar 2023 20:53:20 +0000 (13:53 -0700)] 
s3: smbd: Correctly set smb2req->smb1req->posix_pathnames from the calling fsp on SMB2 calls.

We must always do SMB3+POSIX operations on fsp's opened with a posix create context.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
3 years agosmbd: Ensure share root POSIX attrs are cleared after mode_fn
David Mulder [Thu, 1 Dec 2022 17:53:44 +0000 (10:53 -0700)] 
smbd: Ensure share root POSIX attrs are cleared after mode_fn

The call to mode_fn (smbd_dirptr_lanman2_mode_fn)
was filling the cleared attributes back in to the
stat. Ensure the clear happens after this call.

Signed-off-by: David Mulder <dmulder@samba.org>
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
3 years agos3: smbd: Add check_path_syntax_smb2_posix().
Jeremy Allison [Tue, 28 Mar 2023 18:06:36 +0000 (11:06 -0700)] 
s3: smbd: Add check_path_syntax_smb2_posix().

Not yet used. Simple wrapper, identical to check_path_syntax_posix().
I want to keep SMB1/SMB2 code as separate as possible so
we can remove any SMB1 code path later.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
3 years agos3: smbd: Flatten the check_path_syntax_smb2() wrapper.
Jeremy Allison [Tue, 28 Mar 2023 18:03:59 +0000 (11:03 -0700)] 
s3: smbd: Flatten the check_path_syntax_smb2() wrapper.

Keep it, rather and move all SMB2 code to check_path_syntax()
as I want to keep SMB1/SMB2 code as separate as possible so
we can remove any SMB1 code path later.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
3 years agos4:kdc: Add support for AD device claims
Joseph Sutton [Tue, 28 Mar 2023 21:56:22 +0000 (10:56 +1300)] 
s4:kdc: Add support for AD device claims

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Fri Mar 31 09:30:17 UTC 2023 on atb-devel-224

3 years agos4:kdc: Add support for AD client claims
Joseph Sutton [Mon, 20 Mar 2023 03:58:47 +0000 (16:58 +1300)] 
s4:kdc: Add support for AD client claims

We now create a client claims blob and add it to the PAC.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agoselftest: Account for have_fast_support in determining whether FAST is supported
Joseph Sutton [Thu, 30 Mar 2023 19:38:09 +0000 (08:38 +1300)] 
selftest: Account for have_fast_support in determining whether FAST is supported

have_fast_support is unconditionally set to 1, so this doesn't change
any behaviour.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agos4-dsdb: Account for Claims Valid SID in tokenGroups
Joseph Sutton [Wed, 29 Mar 2023 02:54:26 +0000 (15:54 +1300)] 
s4-dsdb: Account for Claims Valid SID in tokenGroups

More of these tests now pass against Windows. They still don't quite all
pass, but that's something to fix for another day.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agos4:torture: Make use of torture_assert_sid_equal()
Joseph Sutton [Wed, 29 Mar 2023 01:34:57 +0000 (14:34 +1300)] 
s4:torture: Make use of torture_assert_sid_equal()

This gives a more helpful diagnostic message.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agos4:torture: Assert that SID parsing succeeds
Joseph Sutton [Wed, 29 Mar 2023 01:24:11 +0000 (14:24 +1300)] 
s4:torture: Assert that SID parsing succeeds

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agotests/krb5: Don't expect client claims to be missing
Joseph Sutton [Tue, 28 Mar 2023 22:27:33 +0000 (11:27 +1300)] 
tests/krb5: Don't expect client claims to be missing

For this particular test, we don't care whether they're present or not.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agolibcli/security: Add dom_sid_has_account_domain() to confirm a S-1-5-21 prefix
Joseph Sutton [Wed, 15 Mar 2023 22:25:57 +0000 (11:25 +1300)] 
libcli/security: Add dom_sid_has_account_domain() to confirm a S-1-5-21 prefix

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agos4:kdc: Add utility functions for AD claims
Joseph Sutton [Thu, 2 Mar 2023 20:17:39 +0000 (09:17 +1300)] 
s4:kdc: Add utility functions for AD claims

get_claims_for_principal() is a new function that creates a claims blob
for a principal based on attributes in the database.

It's not hooked into the KDC yet, so this entails no change in
behaviour.

Constructed claims and certificate claims are not supported yet.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agos4:dsdb/schema: Add dsdb_attribute_by_cn_ldb_val()
Joseph Sutton [Thu, 30 Mar 2023 03:00:59 +0000 (16:00 +1300)] 
s4:dsdb/schema: Add dsdb_attribute_by_cn_ldb_val()

This looks up a schema attribute by its CN, similar to
dsdb_class_by_cn_ldb_val().

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agoldb: Add ldb_val -> bool,uint64,int64 parsing functions
Joseph Sutton [Wed, 15 Mar 2023 22:42:04 +0000 (11:42 +1300)] 
ldb: Add ldb_val -> bool,uint64,int64 parsing functions

These functions allow us to parse any value of a message element, not
only the first. They also unambiguously indicate whether an error has
occurred.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agoldb: Split out ldb_val_as_dn() helper function
Joseph Sutton [Thu, 2 Mar 2023 20:17:39 +0000 (09:17 +1300)] 
ldb: Split out ldb_val_as_dn() helper function

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agodocs: update manpage for samba-tool
Rob van der Linde [Thu, 23 Mar 2023 03:13:55 +0000 (16:13 +1300)] 
docs: update manpage for samba-tool

Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Fri Mar 31 08:25:11 UTC 2023 on atb-devel-224

3 years agonetcmd: tests for claims client tool
Rob van der Linde [Thu, 23 Mar 2023 00:51:51 +0000 (13:51 +1300)] 
netcmd: tests for claims client tool

Added delete protected test to known fail as Samba doesn't seem to enforce this yet.

Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agonetcmd: add claim sub-commands to samba-tool domain
Rob van der Linde [Mon, 20 Mar 2023 00:48:56 +0000 (13:48 +1300)] 
netcmd: add claim sub-commands to samba-tool domain

Claim Type:

 * samba-tool domain claim claim-type list
 * samba-tool domain claim claim-type create
 * samba-tool domain claim claim-type delete
 * samba-tool domain claim claim-type modify
 * samba-tool domain claim claim-type view

Claim Value Type:

 * samba-tool domain claim value-type list
 * samba-tool domain claim value-type view

To add a claim type use the attribute name, it will look up the attribute in the attribute schema and use that data type and description.

Claim types can be protected from accidental deletion just like Windows, use --protect

To delete protected claim types use --force.

Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agosd_utils: fix typo in get_sd_as_sddl docstring
Rob van der Linde [Mon, 20 Mar 2023 00:35:24 +0000 (13:35 +1300)] 
sd_utils: fix typo in get_sd_as_sddl docstring

Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agonetcmd: simplify boolean check
Rob van der Linde [Wed, 1 Mar 2023 01:19:15 +0000 (14:19 +1300)] 
netcmd: simplify boolean check

Should use "is" for checking booleans rather than "==" in Python, however these can also be simplified.

Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agonetcmd: domain: move trust command to domain/trust.py
Rob van der Linde [Fri, 31 Mar 2023 00:41:49 +0000 (13:41 +1300)] 
netcmd: domain: move trust command to domain/trust.py

Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agonetcmd: domain: move tombstones command to domain/tombstones.py
Rob van der Linde [Fri, 31 Mar 2023 00:37:01 +0000 (13:37 +1300)] 
netcmd: domain: move tombstones command to domain/tombstones.py

Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agonetcmd: domain: move schemaupgrade command to domain/schemaupgrade.py
Rob van der Linde [Fri, 31 Mar 2023 00:34:20 +0000 (13:34 +1300)] 
netcmd: domain: move schemaupgrade command to domain/schemaupgrade.py

Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agonetcmd: domain: move samba3upgrade command to domain/samba3upgrade.py
Rob van der Linde [Fri, 31 Mar 2023 00:30:17 +0000 (13:30 +1300)] 
netcmd: domain: move samba3upgrade command to domain/samba3upgrade.py

Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agonetcmd: domain: move provision command to domain/provision.py
Rob van der Linde [Fri, 31 Mar 2023 00:28:17 +0000 (13:28 +1300)] 
netcmd: domain: move provision command to domain/provision.py

Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agonetcmd: domain: move paswordsettings command to domain/passwordsettings.py
Rob van der Linde [Fri, 31 Mar 2023 00:18:50 +0000 (13:18 +1300)] 
netcmd: domain: move paswordsettings command to domain/passwordsettings.py

Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agonetcmd: domain: move level command to domain/level.py
Rob van der Linde [Fri, 31 Mar 2023 00:09:14 +0000 (13:09 +1300)] 
netcmd: domain: move level command to domain/level.py

Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agonetcmd: domain: move leave command to domain/leave.py
Rob van der Linde [Fri, 31 Mar 2023 00:05:07 +0000 (13:05 +1300)] 
netcmd: domain: move leave command to domain/leave.py

Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agonetcmd: domain: move keytab command to domain/keytab.py
Rob van der Linde [Fri, 31 Mar 2023 00:02:57 +0000 (13:02 +1300)] 
netcmd: domain: move keytab command to domain/keytab.py

Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agonetcmd: domain: move join command to domain/join.py
Rob van der Linde [Fri, 31 Mar 2023 00:00:26 +0000 (13:00 +1300)] 
netcmd: domain: move join command to domain/join.py

Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
3 years agonetcmd: domain: move info command to domain/info.py
Rob van der Linde [Thu, 30 Mar 2023 23:57:45 +0000 (12:57 +1300)] 
netcmd: domain: move info command to domain/info.py

Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>