Andrew Bartlett [Thu, 5 Sep 2019 03:48:53 +0000 (15:48 +1200)]
Create SECURITY.md
This file location is shown under "Security -> Policy" on GitHub
and helps ensure people with a need to report a security issue
find us the right way.
Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Uri Simchoni <uri@samba.org> Reviewed-by: David Disseldorp <ddiss@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Mon Sep 9 21:13:35 UTC 2019 on sn-devel-184
vfs_delay_inject: add support for brl_[un]lock_windows()
This demonstrates the two ways to handle the retry:
- smb layer retry => plock->context.smblctx = UINT64_MAX
- vfs backend retry => plock->context.smblctx = 0
s3:blocking: split out smbd_smb1_do_locks_setup_timeout()
This function can be called multiple times, but only
the first time will setup the endtime. And the
endtime is relative to the request time and not
the current time.
We should evaluate the timeout condition after the very last
retry and not before.
Otherwise we'd fail to retry when waiting for posix locks.
The problem happens if the client provided timeout is smaller
than the 1 sec (for testing temporary 15 secs) retry.
s3:blocking: split smbd_smb1_do_locks_retry() into _try() and _retry()
This will make it possible to have just one caller to
smbd_do_locks_try() later and use smbd_smb1_do_locks_try()
from within smbd_smb1_do_locks_send().
s3:smb2_lock: call change_to_user_by_fsp() when dbwrap_watched_watch* finishes
This is not strictly required as fd-based calls are used,
but it's more consistent to call SMB_VFS_BRL_LOCK_WINDOWS()
in the same environment on retry.
s3:blocking: call change_to_user_by_fsp() when dbwrap_watched_watch* finishes
This is not strictly required as fd-based calls are used,
but it's more consistent to call SMB_VFS_BRL_LOCK_WINDOWS()
in the same environment on retry.
s4:torture: make rpc.handles.random-assoc test more robust
We've seen failures like this:
RPC-HANDLE-RANDOM-ASSOC
connect samr pipe1
pipe1 uses assoc_group_id[0x00000001]
connect samr pipe2 with assoc_group_id[0xFFFFFFFF]- should fail
Failed to bind to uuid 12345778-1234-abcd-ef00-0123456789ac for
ncacn_np:localdc[\pipe\samr,bigendian,assoc_group_id=0xffffffff,
abstract_syntax=12345778-1234-abcd-ef00-0123456789ac/0x00000001] NT_STATUS_UNSUCCESSFUL
connect samr pipe3 with assoc_group_id[0x00000000]- should fail
UNEXPECTED(failure): samba4.rpc.handles on ncacn_np with bigendian.random-assoc(ad_dc_default)
REASON: Exception: Exception: ../../source4/torture/rpc/handles.c:546:
status was NT_STATUS_OK, expected NT_STATUS_UNSUCCESSFUL: opening samr pipe3
Prevent that it wraps to 0x00000000
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
Some smbcontrol commands leave the .help pointer NULL, resulting in the
following usage text:
disconnect-dc (null)
notify-cleanup (null)
...
msg-cleanup (null)
Improve this by printing an empty string instead.
Signed-off-by: David Disseldorp <ddiss@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Autobuild-User(master): David Disseldorp <ddiss@samba.org>
Autobuild-Date(master): Mon Sep 9 10:32:53 UTC 2019 on sn-devel-184
ctdb-eventscripts: Fix the regression in 01.reclock.script
Commit ea7708d8c7fa674111ccea58b3cd0757765c702a simplified
01.reclock.script and removed include of functions file which is
required for setting CTDB_HELPER_BINDIR and for die() function.
Signed-off-by: Amitay Isaacs <amitay@gmail.com> Reviewed-by: Martin Schwenke <martin@meltin.net>
Andrew Bartlett [Wed, 4 Sep 2019 23:23:22 +0000 (11:23 +1200)]
docs: Deprecate "lanman auth = yes"
This feature is only available for SMB1 and we need to warn users that this
is going away soon, and allow the removal in a future release under our rules
for parameter deprecation.
Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Thu Sep 5 04:04:18 UTC 2019 on sn-devel-184
Andrew Bartlett [Wed, 4 Sep 2019 23:19:10 +0000 (11:19 +1200)]
docs: Deprecate "encrypt passwords = no"
This feature is only available for SMB1 and we need to warn users that this
is going away soon, and allow the removal in a future release under our rules
for parameter deprecation.
Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
s3:ldap: Fix join with don't exists machine account
Add check for requested replies of existing machine object during join
machine to domain. This solves regression fail during join with error:
"None of the information to be translated has been translated."
https://bugzilla.samba.org/show_bug.cgi?id=14007
Reviewed-by: Guenther Deschner <gd@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Wed Sep 4 17:02:37 UTC 2019 on sn-devel-184
ctdb_pkt_recv_recv() and ctdb_read_packet() give us a non-null hdr on
success, so drop the error path check in favour of an assert.
This fixes a regression in 3913b9a4088b83d6ed7f94d136a26ecfa7e16b35,
where tevent_req_error() may be skipped in the ctdbd_parse_done()
ctdb_pkt_recv_recv() error path.
Reported-by: Stefan Metzmacher <metze@samba.org> Signed-off-by: David Disseldorp <ddiss@samba.org> Reviewed-by: Noel Power <npower@samba.org>
Autobuild-User(master): Noel Power <npower@samba.org>
Autobuild-Date(master): Wed Sep 4 14:20:16 UTC 2019 on sn-devel-184
* Update waf to version 2.0.17 in order to
fix the build with python 3.8.
* Other minor build fixes.
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Wed Sep 4 11:47:04 UTC 2019 on sn-devel-184
Jeremy Allison [Fri, 30 Aug 2019 21:45:13 +0000 (14:45 -0700)]
s3: VFS: Complete the replacement of SMB_VFS_SYMLINK() -> SMB_VFS_SYMLINKAT().
Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Böhme <slow@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Sep 3 22:32:30 UTC 2019 on sn-devel-184
Jeremy Allison [Mon, 26 Aug 2019 18:22:35 +0000 (11:22 -0700)]
s3/4: libsmbclient test. Test using smbc_telldir/smbc_lseekdir with smbc_readdir/smbc_readdirplus/smbc_getdents.
Ensure that for file access you can mix any of these
three access methods for directory entries and the
returned names/structs stay in sync across telldir/seekdir
changes.
Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Böhme <slow@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Sep 3 17:31:29 UTC 2019 on sn-devel-184
CVE-2019-10197: smbd: split change_to_user_impersonate() out of change_to_user_internal()
This makes sure we always call chdir_current_service() even
when we still impersonated the user. Which is important
in order to run the SMB* request within the correct working directory
and only if the user has permissions to enter that directory.
It makes sure we always update conn->lastused_count
in chdir_current_service() for each request.
Note that vfs_ChDir() (called from chdir_current_service())
maintains its own cache and avoids calling SMB_VFS_CHDIR()
if possible.
It means we still avoid syscalls if we get a multiple requests
for the same session/tcon tuple.
CVE-2019-10197: smbd: make sure that change_to_user_internal() always resets current_user.done_chdir
We should not leave current_user.done_chdir as true if we didn't call
chdir_current_service() with success.
This caused problems in when calling vfs_ChDir() in pop_conn_ctx() when
chdir_current_service() worked once on one share but later failed on another
share.
Björn Baumbach [Thu, 13 Jun 2019 15:20:02 +0000 (17:20 +0200)]
build: remove unneeded libceph-common dependency
librados and libcephfs are both dependent on ceph-common, but
ctdb_mutex_ceph_rados_helper and vfs_ceph needn't be explicitly linked
against it.
Signed-off-by: Björn Baumbach <bb@samba.org> Reviewed-by: David Disseldorp <ddiss@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Mon Sep 2 03:44:24 UTC 2019 on sn-devel-184
David Disseldorp [Tue, 18 Jun 2019 12:35:02 +0000 (14:35 +0200)]
build: drop --with-libcephfs=<path> support
--with-libcephfs=<path> provides a mechanism for explicitly specifying
header and library paths for Ceph. This adds unnecessary complexity and
can be achieved using generic compiler environment variables (e.g.
GCC LIBRARY_PATH and C_INCLUDE_PATH), so drop --with-libcephfs support.
Signed-off-by: David Disseldorp <ddiss@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Andrew Bartlett [Mon, 26 Aug 2019 02:36:49 +0000 (14:36 +1200)]
build: Raise minimum python version to 3.5.0 for Samba 4.12
Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Martin Schwenke <martin@meltin.net>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Mon Sep 2 01:14:05 UTC 2019 on sn-devel-184
Andrew Bartlett [Fri, 30 Aug 2019 10:12:03 +0000 (22:12 +1200)]
dsdb: Remove unused local_password module
This was an idea about how Samba might have worked if passwords were
not safe to be stored in a remote DB (get some kind of LDAP backend).
Nothing ever used this, but it was a nice idea. But git master is not
the place to preserve history, even interesting ideas like splitting
passwords from the non-password data (possible because, in the same way
we are allowed to encrypt them, we do not allow a search on password
values).
Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Andrew Bartlett [Fri, 30 Aug 2019 08:38:01 +0000 (20:38 +1200)]
util: Remove unused NS_GUID_string() and NS_GUID_from_string()
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14063 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Andrew Bartlett [Fri, 30 Aug 2019 08:44:57 +0000 (20:44 +1200)]
dsdb: Remove unused entryuuid and nsuniqueid modules
These were for the now removed OpenLDAP backend. Any future work in this area will
not involve this kind of translation, it will be done much more cleanly.
Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Mathieu Parent [Thu, 29 Aug 2019 20:44:54 +0000 (22:44 +0200)]
Spelling fixes s/ querys / queries /
Signed-off-by: Mathieu Parent <math.parent@gmail.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Sun Sep 1 23:38:14 UTC 2019 on sn-devel-184
projects / thirdparty / samba.git / log
