Jeremy Allison [Thu, 27 May 2021 05:41:53 +0000 (22:41 -0700)]
s3: smbd: Fix uninitialized memory read in process_symlink_open() when used with vfs_shadow_copy2().
Valgrind trace follows.
==3627798== Invalid read of size 1
==3627798== at 0x483FF46: strlen (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==3627798== by 0x55DE412: strdup (strdup.c:41)
==3627798== by 0x4F4657E: smb_xstrdup (util.c:660)
==3627798== by 0x4C62C2E: vfs_ChDir (vfs.c:988)
==3627798== by 0x4C4A51C: process_symlink_open (open.c:656)
==3627798== by 0x4C4ADE7: non_widelink_open (open.c:862)
==3627798== by 0x4C4AFB7: fd_openat (open.c:918)
==3627798== by 0x4BBE895: openat_pathref_fsp (files.c:506)
==3627798== by 0x4C48A00: filename_convert_internal (filename.c:2027)
==3627798== by 0x4C48B77: filename_convert (filename.c:2067)
==3627798== by 0x4C32408: call_trans2qfilepathinfo (trans2.c:6173)
==3627798== by 0x4C3C5DA: handle_trans2 (trans2.c:10143)
==3627798== Address 0xda8bc90 is 96 bytes inside a block of size 217 free'd
==3627798== at 0x483DA3F: free (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==3627798== by 0x4FCA3C9: _tc_free_internal (talloc.c:1222)
==3627798== by 0x4FCA481: _talloc_free_internal (talloc.c:1248)
==3627798== by 0x4FCB825: _talloc_free (talloc.c:1792)
==3627798== by 0xDB248DD: store_cwd_data (vfs_shadow_copy2.c:1473)
==3627798== by 0xDB24BEF: shadow_copy2_chdir (vfs_shadow_copy2.c:1542)
==3627798== by 0x4C662A4: smb_vfs_call_chdir (vfs.c:2257)
==3627798== by 0x4C62B48: vfs_ChDir (vfs.c:940)
==3627798== by 0x4C4A51C: process_symlink_open (open.c:656)
==3627798== by 0x4C4ADE7: non_widelink_open (open.c:862)
==3627798== by 0x4C4AFB7: fd_openat (open.c:918)
==3627798== by 0x4BBE895: openat_pathref_fsp (files.c:506)
==3627798== Block was alloc'd at
==3627798== at 0x483C7F3: malloc (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==3627798== by 0x4FC9365: __talloc_with_prefix (talloc.c:783)
==3627798== by 0x4FC94FF: __talloc (talloc.c:825)
==3627798== by 0x4FCCFDC: __talloc_strlendup (talloc.c:2454)
==3627798== by 0x4FCD096: talloc_strdup (talloc.c:2470)
==3627798== by 0xDB24977: store_cwd_data (vfs_shadow_copy2.c:1476)
==3627798== by 0xDB24BEF: shadow_copy2_chdir (vfs_shadow_copy2.c:1542)
==3627798== by 0x4C662A4: smb_vfs_call_chdir (vfs.c:2257)
==3627798== by 0x4C62B48: vfs_ChDir (vfs.c:940)
==3627798== by 0x4C4A92D: non_widelink_open (open.c:755)
==3627798== by 0x4C4AFB7: fd_openat (open.c:918)
==3627798== by 0x4BBE895: openat_pathref_fsp (files.c:506)
==3627798==
Even though SMB_VFS_CONNECTPATH() returns a const char,
vfs_shadow_copy2() can free and reallocate this whilst
in use inside process_symlink_open().
Take a copy to make sure we don't reference free'd memory.
Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Böhme <slow@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu May 27 17:25:43 UTC 2021 on sn-devel-184
docs-xml: Update pdbedit manpage for new cmdline opition parser
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Tue May 25 01:14:09 UTC 2021 on sn-devel-184
Pavel Filipenský [Wed, 19 May 2021 11:12:31 +0000 (13:12 +0200)]
docs: Update list of available commands in rpcclient
The list of available commands in rpcclient.1 manpage is updated to
match the current state, which is visible via help commnad of rpcclient.
Signed-off-by: Pavel Filipenský <pfilipen@redhat.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
Pavel Filipenský [Wed, 19 May 2021 12:51:00 +0000 (14:51 +0200)]
s3:rpcclient: Document command of witness protocol
Signed-off-by: Pavel Filipenský <pfilipen@redhat.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
Jeremy Allison [Fri, 21 May 2021 17:53:49 +0000 (10:53 -0700)]
s3: smbd: Allow SMB1+UNIX extensions rename of dangling symlink.
Remove knownfail. Only in master, so no bug number needed.
Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Noel Power <noel.power@suse.com>
Autobuild-User(master): Noel Power <npower@samba.org>
Autobuild-Date(master): Mon May 24 17:47:40 UTC 2021 on sn-devel-184
Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Mon May 24 16:56:22 UTC 2021 on sn-devel-184
Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Fri May 21 14:14:38 UTC 2021 on sn-devel-184
Jeremy Allison [Thu, 20 May 2021 16:28:29 +0000 (09:28 -0700)]
s3: smbd: Change set_create_timespec_ea() to take the existing fsp.
Removes an unneeded synthetic_pathref() call.
Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Thu May 20 19:59:44 UTC 2021 on sn-devel-184
Dmytro Bagrii [Thu, 13 May 2021 14:53:44 +0000 (17:53 +0300)]
lib:util: Fix log level for normal startup message
Message "daemon 'smbd' finished starting up and ready to serve connections"
indicates normal startup but printed with 'error' log level and may be mistakenly
treated as error during logs analisys. This patch changes log level to 'info'.
Signed-off-by: Dmytro Bagrii <dimich.dmb@gmail.com> Reviewed-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Thu May 20 15:07:28 UTC 2021 on sn-devel-184
gitlab-ci: Install devel files for tracker-sparql (spotlight backend)
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Thu May 20 12:01:06 UTC 2021 on sn-devel-184
s3:smbd: Initialize command for spools printer control
./../source3/smbd/lanman.c: In function ‘api_WPrintQueueCtrl’:
../../source3/smbd/lanman.c:3342:9: error: ‘command’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
s3:utils: Migrate tevent_glib_tracker to new cmdline option parser
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Thu May 20 03:49:30 UTC 2021 on sn-devel-184
selftest: Rename offline logon env to ad_member_offlogon
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Wed May 19 20:01:00 UTC 2021 on sn-devel-184
Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Noel Power <npower@samba.org>
Autobuild-User(master): Noel Power <npower@samba.org>
Autobuild-Date(master): Wed May 19 09:22:56 UTC 2021 on sn-devel-184
Joseph Sutton [Mon, 10 May 2021 03:06:06 +0000 (15:06 +1200)]
python: Make credentials cache test run against Windows
Windows, unlike Samba, requires the service principal name to be set
when requesting a ticket to that service.
Additionally, default_realm from the libdefaults section of krb5.conf
should be set so that the correct realm is used.
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Wed May 19 02:22:01 UTC 2021 on sn-devel-184
Joseph Sutton [Mon, 10 May 2021 04:43:03 +0000 (16:43 +1200)]
python: Fix ticket timestamp conversion when local timezone is not UTC
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Joseph Sutton [Mon, 3 May 2021 02:43:04 +0000 (14:43 +1200)]
python: Fix erroneous increments of reference counts
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Joseph Sutton [Mon, 3 May 2021 02:42:10 +0000 (14:42 +1200)]
python: Ensure reference counts are properly incremented
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Joseph Sutton [Thu, 29 Apr 2021 20:58:11 +0000 (08:58 +1200)]
python: Add SMB credentials cache test
Test that we can use a credentials cache with a user's service ticket
obtained with our Python code to connect to a service through SMB.
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Joseph Sutton [Fri, 30 Apr 2021 00:49:24 +0000 (12:49 +1200)]
pylibsmb: Add posix_whoami()
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Joseph Sutton [Mon, 3 May 2021 04:24:42 +0000 (16:24 +1200)]
libsmb: Ensure that whoami parses all the data provided to it
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Joseph Sutton [Mon, 3 May 2021 04:22:43 +0000 (16:22 +1200)]
libsmb: Check to see that whoami is not receiving more data than it requested
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Joseph Sutton [Mon, 3 May 2021 04:16:51 +0000 (16:16 +1200)]
libsmb: Avoid undefined behaviour when parsing whoami state
If num_gids is such that the gids array would overflow the rdata buffer,
'p + 8' could produce a result pointing outside the buffer, and thus
result in undefined behaviour. To avoid this, we check num_gids against
the size of the buffer beforehand.
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Joseph Sutton [Mon, 3 May 2021 03:55:01 +0000 (15:55 +1200)]
libsmb: Remove overflow check
Pointer overflow is undefined, so this check does not accomplish
anything.
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
This code originally used ndr_pull_struct_blob() to pull one SID from a
buffer potentially containing multiple SIDs. When this was changed to
use sid_parse(), it was now attempting to parse the whole buffer as a
single SID with ndr_pull_struct_blob_all(), which would cause it to fail
if more than one SID was present.
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Joseph Sutton [Thu, 29 Apr 2021 09:04:25 +0000 (21:04 +1200)]
python: Add RPC credentials cache test
Test that we can use a credentials cache with a user's service ticket
obtained with our Python code to connect to a service through RPC.
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Joseph Sutton [Thu, 29 Apr 2021 08:58:11 +0000 (20:58 +1200)]
python: Add LDAP credentials cache test
Test that we can use a credentials cache with a user's service ticket
obtained with our Python code to connect to a service through LDAP.
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Joseph Sutton [Tue, 27 Apr 2021 23:06:33 +0000 (11:06 +1200)]
python: Add credentials cache test
Test that we can use a credentials cache with a user's service ticket
obtained with our Python code to connect to a service using the normal
credentials system backed on to MIT/Heimdal Kerberos 5 libraries. This
will allow us to validate the output of the MIT/Heimdal libraries in the
future.
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Joseph Sutton [Tue, 27 Apr 2021 23:02:47 +0000 (11:02 +1200)]
krb5: Add Python functions to create a credentials cache containing a service ticket
This is a FILE: format credentials cache readable by the MIT/Heimdal
Kerberos libraries. This allows us to glue the Python ASN1 Kerberos
system to the MIT/Heimdal one.
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Joseph Sutton [Tue, 27 Apr 2021 22:58:48 +0000 (10:58 +1200)]
librpc: Test parsing a Kerberos 5 credentials cache with ndrdump
This is the format used by the FILE: credentials cache type.
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Joseph Sutton [Tue, 27 Apr 2021 22:57:00 +0000 (10:57 +1200)]
krb5ccache.idl: Add definition for a Kerberos credentials cache
Based on specifications found at
https://web.mit.edu/kerberos/krb5-devel/doc/formats/ccache_file_format.html
This is primarily designed for parsing and storing a single Kerberos
ticket, due to the limitations of PIDL.
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Joseph Sutton [Tue, 27 Apr 2021 23:07:22 +0000 (11:07 +1200)]
pygensec: Fix method documentation
This changes the docstrings to use the correct method names.
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Joseph Sutton [Tue, 27 Apr 2021 22:55:13 +0000 (10:55 +1200)]
auth:creds: Fix parameter in creds.set_named_ccache()
Use the passed-in value for 'obtained' rather than always using
CRED_SPECIFIED.
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Joseph Sutton [Tue, 27 Apr 2021 22:54:05 +0000 (10:54 +1200)]
auth:creds: Remove unused variable
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Jeremy Allison [Mon, 17 May 2021 21:01:43 +0000 (14:01 -0700)]
s3: lib: Fix the solaris build. Commit 8d0ea8bafa00 added SMB_ACL_TYPE_T type to solarisacl_sys_acl_set_fd() in the .c file, but not the .h.
The fact no one noticed means currently no one is
building master on Solaris/Illumos/OmniOS.
Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue May 18 19:23:25 UTC 2021 on sn-devel-184
Jeremy Allison [Sat, 15 May 2021 04:41:49 +0000 (21:41 -0700)]
s3: VFS: Update status of SMB_VFS_SYS_ACL_DELETE_DEF_FILE() and SMB_VFS_SYS_ACL_DELETE_DEF_FD().
Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Noel Power <npower@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue May 18 18:19:28 UTC 2021 on sn-devel-184
Leave the called function as that's in the public API.
We will be able to get rid of it when we delete sys_acl_delete_def_file()
after all the callers are gone.
Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Noel Power <npower@samba.org>
projects / thirdparty / samba.git / log
