s3:rpc_server: Only dump passwords in developer builds
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Fri Jul 26 03:05:01 UTC 2019 on sn-devel-184
David Disseldorp [Fri, 12 Jul 2019 15:29:23 +0000 (17:29 +0200)]
netlogon: Fix potential use of uninitialized variable
The _netr_NetrEnumerateTrustedDomains()->dcerpc_lsa_open_policy2() error
path checks the policy handle and closes it if non-empty. The policy
handle may be uninitialized in this code-path - fix this.
Signed-off-by: David Disseldorp <ddiss@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
lib:crypto: Don't build RC4 if we have GnuTLS >= 3.4.7
We have a GnuTLS DCEPRC backupkey implementation for the server and the
test. However this is only working with GnuTLS >= 3.4.7. So we need to
keep this around till we can require at least GnuTLS in a newer version.
Noel Power [Tue, 9 Jul 2019 16:07:09 +0000 (16:07 +0000)]
s3/lib: clang: Fix 'access to field results in a deref of a null pointer'
Fixes:
source3/lib/ctdbd_conn.c:1953:6: warning: Access to field 'operation' results in a dereference of a null pointer (loaded from variable 'hdr') <--[clang]
if (hdr->operation != CTDB_REPLY_CALL) {
^~~
Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Autobuild-User(master): Gary Lockyer <gary@samba.org>
Autobuild-Date(master): Wed Jul 24 22:50:27 UTC 2019 on sn-devel-184
Noel Power [Tue, 9 Jul 2019 16:05:37 +0000 (16:05 +0000)]
s3/lib: clang: Fix 'function call argument is an uninitialized value'
Fixes:
source3/lib/ctdbd_conn.c:1066:3: warning: 3rd function call argument is an uninitialized value <--[clang]
DEBUG(0,("ctdbd_control failed: %s, %d\n", strerror(ret),
^
Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Noel Power [Tue, 9 Jul 2019 16:02:47 +0000 (16:02 +0000)]
s3/lib: clang: Fix 'Acces to field results in a deref of a null pointer'
Fixes:
source3/lib/ctdbd_conn.c:415:6: warning: Access to field 'operation' results in a dereference of a null pointer (loaded from variable 'hdr') <--[clang]
if (hdr->operation == CTDB_REQ_MESSAGE) {
Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Noel Power [Tue, 9 Jul 2019 14:50:24 +0000 (14:50 +0000)]
lib/addns: clang: Fix 'Value stored to 'err' is never read'
Fixes:
/home/samba/samba/lib/addns/dnsmarshall.c:406:2: warning: Value stored to 'err' is never read <--[clang]
err = ERROR_DNS_NO_MEMORY;
^ ~~~~~~~~~~~~~~~~~~~
/home/samba/samba/lib/addns/dnsmarshall.c:447:3: warning: Value stored to 'err' is never read <--[clang]
err = buf->error;
^ ~~~~~~~~~~
2 warnings generated.
Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Noel Power [Tue, 9 Jul 2019 14:45:52 +0000 (14:45 +0000)]
libcls/nbt: clang: Fix 'initialization value is never read'
Fixes:
libcli/nbt/nbtsocket.c:65:27: warning: Value stored to 'req' during its initialization is never read <--[clang]
struct nbt_name_request *req = nbtsock->send_queue;
^~~ ~~~~~~~~~~~~~~~~~~~
1 warning generated.
Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Noel Power [Tue, 9 Jul 2019 14:42:46 +0000 (14:42 +0000)]
s3/lib/dbwrap: clang: Fix 'Access to field results in a deref of a null'
Fixes:
source3/lib/dbwrap/dbwrap_ctdb.c:530:39: warning: Access to field 'm_write' results in a dereference of a null pointer (loaded from field 'transaction') <--[clang]
if (pull_newest_from_marshall_buffer(ctx->transaction->m_write, key,
Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Noel Power [Tue, 9 Jul 2019 14:04:34 +0000 (14:04 +0000)]
libcli/smb: clang: Fix Value stored to 'next_offset' is never read
Fixes:
ibcli/smb/smb2_negotiate_context.c:117:3: warning: Value stored to 'next_offset' is never read <--[clang]
next_offset += next_pad;
^ ~~~~~~~~
1 warning generated.
Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Douglas Bagnall [Wed, 24 Jul 2019 03:43:46 +0000 (15:43 +1200)]
s4/dsdb/replmd: use incoming_dn_should_be_renamed() 2/2
In replmd_replicated_handle_rename().
The helper function was introduced two commits ago and consists of
a large common stretch of this and the function modified in the previous
commit.
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Jul 24 11:21:50 UTC 2019 on sn-devel-184
Douglas Bagnall [Wed, 24 Jul 2019 03:16:36 +0000 (15:16 +1200)]
s4/dsdb/replmd: add a helper for common calculations
We currently do exactly this work, in exactly these words (ignoring
formatting) in two different places. The next two commits will make
those places use this helper function. We do this over three commits
so that we can more easily compare the next two and be sure they are
doing the same thing.
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Jeremy Allison [Wed, 17 Jul 2019 16:55:58 +0000 (09:55 -0700)]
s3: smbd: Naming consistency. Change all uses of struct smb_Dir * variables to be dir_hnd.
Fixes SearchDir(). No logic changes.
Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Wed Jul 24 08:57:05 UTC 2019 on sn-devel-184
Jeremy Allison [Wed, 17 Jul 2019 16:11:25 +0000 (09:11 -0700)]
s3: smbd: Move the setting of the destructor of struct smb_Dir * up two levels.
Previously, open_dir_safely() called OpenDir_internal() which
set the destructor.
Move setting the destructor into the callers of open_dir_safely()
as this will allow us to have different destructors for handle-based
calls.
The reason this is important is that I have a follow up patchset
that depends on this which makes all client directory enumerations
handle-based, calling OpenDir_fsp() only, and so the destructor there
will take care of the fsp back pointer.
Trying to keep a common destructor for handle-based and non-handle
based calls broke my brain when trying to separate the handle-based
calls from the non-handle based ones in my later patchset.
NB. The change in OpenDir_fsp() isn't a logic change as instead
of doing an early return from a function that sets the destructor,
we now fallthrough to setting the destructor then return, which
is identical.
Eventually the whole codepath using the fallback for non-handle
opens inside dptr_create() will go away and this simplifies the
code immensely. Some short term pain for long-term gain :-).
Added doxygen documentation as requested.
Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
Jeremy Allison [Wed, 17 Jul 2019 15:56:49 +0000 (08:56 -0700)]
s3: smbd: OpenDir() is merely a wrapper around open_dir_safely().
Preparatory work.
Separate these out internal to source3/smbd/dir.c so I can
give the internal and external uses separate destructor functions
to allow all client requested directory enumeration to move to handle
based functions.
Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
Tim Beale [Wed, 24 Jul 2019 02:17:06 +0000 (14:17 +1200)]
netcmd: Better error message for backup with no RID pool
Add a better error message (and what to do about it) if the user tries
to back up a DC that hasn't initialized its RID pool yet.
Seems to be a fairly common problem hit by users.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14048
RN: Added more informative error message if the 'samba-tool domain
backup' command fails due to no RID pool being present on the DC.
Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Jul 24 07:07:01 UTC 2019 on sn-devel-184
Unlock partition databases in the reverse order from which they were
acquired. This is separated from the previous commit for future
bisecting purposes, since the last commit was made to fix specific CI
failures, while this one is a speculative fix made based on code
inspection.
Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz> Reviewed-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
A schema reading bug was traced to a lock ordering issue in partition.c.
This patch fixes the problem by:
1. Releasing locks/transactions in the order they were acquired.
2. Always lock/start_trans on metadata.tdb first, before any other
databases, and release it last, after all others. This is so that we are
never exposed to MDB's lock semantics, which we don't support.
Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz> Reviewed-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Noel Power [Fri, 5 Jul 2019 11:34:25 +0000 (11:34 +0000)]
s4/source4/common: clang: Fix 'Dereference of undefined pointer value'
Fixes:
source4/dsdb/common/util.c:3131:6: warning: Dereference of undefined pointer value <--[clang]
if (res->count < 1) {
^
/source4/dsdb/common/util.c:3207:6: warning: Dereference of undefined pointer value <--[clang]
if (res->count < 1) {
^~~~~~~~~~
source4/dsdb/common/util.c:4004:39: warning: Dereference of undefined pointer value <--[clang]
(*wkguid_dn) = talloc_steal(mem_ctx, res->msgs[0]->dn);
^
source4/dsdb/common/util.c:4191:35: warning: Dereference of undefined pointer value <--[clang]
ouv_value = ldb_msg_find_ldb_val(r->msgs[0], "replUpToDateVector");
source4/dsdb/common/util.c:5757:13: warning: 1st function call argument is an uninitialized value <--[clang]
same_nc = (ldb_dn_compare(source_nc, target_nc) == 0);
^
This fix also fixes the associated 'Access to field 'xyx' results in a
dereference of a null pointer' warnings that also will happen when this
is fixed
Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Autobuild-User(master): Gary Lockyer <gary@samba.org>
Autobuild-Date(master): Wed Jul 24 05:49:14 UTC 2019 on sn-devel-184
Noel Power [Fri, 5 Jul 2019 11:07:07 +0000 (11:07 +0000)]
s4/dsdb/common: clang: Fix 'Access results in a deref of a null pointer'
Fixes:
source4/dsdb/common/util.c:2000:6: warning: Access to field 'count' results in a dereference of a null pointer (loaded from variable 'res') <--[clang]
if (res->count != 1) {
^~~
source4/dsdb/common/util.c:3281:28: warning: Access to field 'msgs' results in a dereference of a null pointer (loaded from variable 'res') <--[clang]
el = ldb_msg_find_element(res->msgs[0], attr);
^~~
source4/dsdb/common/util.c:3568:6: warning: Access to field 'count' results in a dereference of a null pointer (loaded from variable 'res') <--[clang]
if (res->count != 1 || ret != LDB_SUCCESS) {
^~~
Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Noel Power [Fri, 5 Jul 2019 11:04:10 +0000 (11:04 +0000)]
s4/dsdb/common: clang: Fix 'The left operand of '&' is a garbage value'
Fixes:
source4/dsdb/common/util.c:1964:18: warning: The left operand of '&' is a garbage value <--[clang]
return (options & DS_NTDSDSA_OPT_IS_GC) != 0;
~~~~~~~ ^
Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Noel Power [Fri, 5 Jul 2019 10:42:54 +0000 (10:42 +0000)]
s4/dsdb/common: clang: Fix 'function call argument is an uninitialized value'
Fixes:
source4/dsdb/common/util.c:1804:8: warning: 3rd function call argument is an uninitialized value <--[clang]
ret = samdb_reference_dn(ldb, mem_ctx, server_ref_dn, "rIDSetReferences", dn);
Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Noel Power [Fri, 5 Jul 2019 10:24:53 +0000 (10:24 +0000)]
s4/auth/kerberos: clang: Fix 'value stored to 'ret' is never read '
Fixes:
source4/auth/kerberos/kerberos_pac.c:116:2: warning: Value stored to 'ret' is never read <--[clang]
ret = smb_krb5_make_pac_checksum(mem_ctx,
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Tim Beale [Tue, 23 Jul 2019 23:00:01 +0000 (11:00 +1200)]
join: Use a specific attribute order for the DsAddEntry nTDSDSA object
Joining a Windows domain can throw an error if the HasMasterNCs
attribute occurs before msDS-HasMasterNCs. This patch changes the
attribute order so that msDS-HasMasterNCs is always first.
Previously on python2, the dictionary hash order was arbitrary but
constant. By luck, msDS-HasMasterNCs was always before HasMasterNCs, so
we never noticed any problem. With python3, the dictionary hash order
now changes everytime you run the command, so the order is
unpredictable.
To enforce a order, we can change to use an OrderedDict, which will
return the keys in the order they're added.
I've asked Microsoft to clarify the protocol requirement here WRT
attribute order. However, in the meantime we may as well fix the problem
for users.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14046
RN: When trying to join a Windows domain (with functional level 2008R2)
as an AD domain controller, the 'samba-tool domain join' command could
throw a python exception: 'RuntimeError ("DsAddEntry failed")'. When
this problem occurred, you would also see the message "DsAddEntry failed
with status WERR_ACCESS_DENIED info (8363, 'WERR_DS_NO_CROSSREF_FOR_NC')"
in the command output. This issue has now been resolved. Note that this
problem would only occur on Samba v4.10 when using the Python3 packages.
Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Jul 24 04:18:21 UTC 2019 on sn-devel-184
Tim Beale [Wed, 19 Jun 2019 21:20:09 +0000 (09:20 +1200)]
traffic_replay: Avoid DB full scans in LDAP searches
When generating LDAP search traffic, a full DB scan can be very costly.
Avoiding full-scan LDAP searches means that we can run traffic_replay
against a 100K user DB and get some sane results.
Because the traffic_learner doesn't record the LDAP search filter at all,
the traffic_replay LDAP searches default to being full scans.
Doing full scans meant that the LDAP search was usually the first packet
type to exceed the max latency and fail the test. It could also skew
results for the other packet types by creating big demands on memory/CPU/
DB-lock-time.
It's hard to know for sure exactly what real-world LDAP searches will
look like, but let's assume full scan searches will be fairly rare.
In traffic-model files we've collected previously, some of the
attributes are fairly unique (e.g. pKIExtendedKeyUsage), and as there
are some LDAP queries specified in MS specs (such as MS-GPOL and
MS-WCCE), it allows us to infer what the search filter might be.
Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
projects / thirdparty / samba.git / log
