summaryrefslogtreecommitdiff
path: root/lib
Commit message (Collapse)AuthorAgeFilesLines
* ldb: Release ldb 1.4.7ldb-1.4.7Stefan Metzmacher2019-07-034-1/+284
| | | | | | | | | | | | | Compared to 1.4.6: * LDAP_REFERRAL_SCHEME_OPAQUE was added to ldb_module.h in order to fix bug #12478. It means that Samba >= 4.9.11 is no longer able to build with ldb 1.4.6. BUG: https://bugzilla.samba.org/show_bug.cgi?id=12478 Signed-off-by: Stefan Metzmacher <metze@samba.org>
* ldap server: generate correct referral schemesGary Lockyer2019-06-211-0/+5
| | | | | | | | | | | | | | | | Ensure that the referrals returned in a search request use the same scheme as the request, i.e. referrals recieved via ldap are prefixed with "ldap://" and those over ldaps are prefixed with "ldaps://" BUG: https://bugzilla.samba.org/show_bug.cgi?id=12478 Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Fri May 24 05:12:14 UTC 2019 on sn-devel-184 (cherry picked from commit 1958cd8a7fb81ec51b81944ecf4dd0fb5c4208fa)
* lib: util: Finally remove possibilities of using sys_popen() unsafely.Jeremy Allison2019-06-132-96/+0
| | | | | | | | | | | | | | All code now uses sys_popenv() which is much harder to use incorrectly. Remove the extract_args() function that was the cause of possible issues. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13964 Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit 9fa95d5b45369acfdd38923e8618e94e5d04b07e)
* lib: util: Remove file_pload()Jeremy Allison2019-06-132-47/+0
| | | | | | | | | | No longer used. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13964 Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit c5729ae44219ec81008040d4d50f0f5fdf254201)
* lib: util: Add file_ploadv().Jeremy Allison2019-06-132-0/+47
| | | | | | | | | | | | | | Not yet used. Duplicate code to file_pload() except uses vectored argument list. file_pload() will be removed once all callers are converted. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13964 Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit 5c34fa0b85e4d9a3c5fd4fa0b39af4772ec023db)
* lib: popen: Prepare to remove sys_popen().Jeremy Allison2019-06-132-20/+38
| | | | | | | | | | | | | | | Add sys_popenv(char * const argl[]) that uses a NULL terminated vector array of args. Change sys_popen() to split up its command string and call sys_popenv(). Once all callers are converted to sys_popenv() we can remove sys_popen(). BUG: https://bugzilla.samba.org/show_bug.cgi?id=13964 Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit f20538de041eed1cadbabe2149b2b7cfcb779cb5)
* s3:util: Move static file_pload() function to lib/utilAliaksei Karaliou2019-06-132-0/+53
| | | | | | | | | | | | | | | file_pload() is static private function in Samba3 library, however it does not have any special dependencies and might be widely used as common function, so moving it into common samba-util library. Extra fix needed to enable easy back-port of code for: BUG: https://bugzilla.samba.org/show_bug.cgi?id=13964 Signed-off-by: Aliaksei Karaliou <akaraliou@panasas.com> Reviewed-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> (cherry picked from commit d21fc7d8b86b0cddc619ffe528d9cd93eeedbb0b)
* s3:util: Move popen wrappers to lib/utilAliaksei Karaliou2019-06-133-2/+282
| | | | | | | | | | | | | | | | | When linked into Samba3 libraries, sys_popen()/sys_pclose() cannot be used in lower level libraries because of circular dependencies. This patch moves them into common samba-util library. Extra fix needed to enable easy back-port of code for: BUG: https://bugzilla.samba.org/show_bug.cgi?id=13964 Signed-off-by: Aliaksei Karaliou <akaraliou@panasas.com> Reviewed-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> (cherry picked from commit 65ea3f2a461c0eeca7d14c4258eea52e19f0ed06)
* lib:torture: Fix string comparison macros where we directly pass NULLAndreas Schneider2019-05-171-3/+5
| | | | | | | | | | | | See e.g. lib/util/tests/strlist.c +177 Found by GCC 9. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13937 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> (cherry picked from commit a8f773e326d6bdfc1c9eb87a74c00108f6620c56)
* s3:debug: enable logging for early startup failuresRalph Wuerthner2019-05-171-0/+19
| | | | | | | | | | | | | | | | | | | Commit c89a33a07a 'debug: Use backends instead of explicitly logging to syslog or file' introduced a regression where early startup failures (e.g. unable to connect to CTDB) are no longer logged because the debug subsystem is not yet fully initialized. Enable logging again with reasonable defaults when reopen_logs() is called and the parameter file is not yet parsed. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13904 Signed-off-by: Ralph Wuerthner <ralph.wuerthner@de.ibm.com> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Christof Schmitt <cs@samba.org> Autobuild-User(master): Christof Schmitt <cs@samba.org> Autobuild-Date(master): Thu Apr 18 22:21:15 UTC 2019 on sn-devel-144 (cherry picked from commit 9b30fcda64080592d20de64b384fd6d3d0775cbf)
* s3:debug: adjust indentionRalph Wuerthner2019-05-171-2/+4
| | | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=13904 Signed-off-by: Ralph Wuerthner <ralph.wuerthner@de.ibm.com> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Christof Schmitt <cs@samba.org> (cherry picked from commit a45675879ddcb43ab274d28496eedd6833466ae4)
* s3:debug: use struct initializerRalph Wuerthner2019-05-171-10/+9
| | | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=13904 Signed-off-by: Ralph Wuerthner <ralph.wuerthner@de.ibm.com> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Christof Schmitt <cs@samba.org> (cherry picked from commit b9e1b4ad0033c211710da285c30d603ccb8b8d40)
* debug: add a call to debug_parse_levels() to reopen_logs()Ralph Boehme2019-05-171-0/+1
| | | | | | | | This allows correct refresh of the "log level" setting when reloading config. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> (cherry picked from commit 4341f24069f991dc7119093e418aac392e0a1b50)
* debug: add an empty lineRalph Boehme2019-05-171-0/+1
| | | | | | Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> (cherry picked from commit 2bc7e254a62cfc6a60ecff425fc71173c6d21a10)
* lib util debug: Increase format buffer to 4KiBGary Lockyer2019-05-171-1/+1
| | | | | | | | | | | | | | | | | Increase the debug line buffer to 4KiB, the existing size of 1KiB is too small for dsdbChange JSON audit messages. These messages were then split across multipe lines causing issues in log ingestion tools expecting single line messages. Bug: https://bugzilla.samba.org/show_bug.cgi?id=13902 Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(master): Gary Lockyer <gary@samba.org> Autobuild-Date(master): Mon May 6 01:18:22 UTC 2019 on sn-devel-184 (cherry picked from commit ad3af7cdffb98b7998857db609548fc96f60c669)
* memcache: Increase size of default memcache to 512kChristof Schmitt2019-04-121-1/+1
| | | | | | | | | | | | With the fixed accounting of talloc objects, the default cache size needs to increase. The exact increase required depends on the workloads, going form 256k to 512k seems like a reasonable guess. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13865 Signed-off-by: Christof Schmitt <cs@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> (cherry picked from commit 9ff5c0bab76c5d3d7bea1fcb79861d0c9a3b9839)
* memcache: Properly track the size of talloc objectsChristof Schmitt2019-04-121-0/+19
| | | | | | | | | | | | | | | | | | | | | | With memcache_add_talloc, the talloc object becomes part of the pool and the memcache_element stores a pointer to the talloc object. The size of the the talloc object was not used when tracking the used space, allowing the cache to grow larger than defined in the memcache_init call. Fix this by adding the size of the talloc object to the used space. Also record the initial size of the talloc object for proper adjustment of the used space in the cache later. This is in case the size of the talloc object is modified while being owned by the cache (e.g. allocating talloc child objects). This should never happen, but better be safe than ending up with a broken cache usage counter. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13865 Signed-off-by: Christof Schmitt <cs@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> (cherry picked from commit a04ca6f3438595ba7e1a110877f53d1cac0f0402)
* memcache: Introduce struct for storing talloc pointerChristof Schmitt2019-04-121-15/+20
| | | | | | | | | | | This allows extending the additional data stored for talloced objects later. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13865 Signed-off-by: Christof Schmitt <cs@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> (cherry picked from commit 7c44f2f76eefb9156cb1d170c92b4ff07dd6a3d5)
* Send status to systemd on daemon startMarcos Mello2019-03-221-10/+8
| | | | | | | | | | | | | | | | | | | | systemd service files run in no-forking mode (--foreground) since 8b6f58194da7e849cdb9d20712dff49b17a93a77. Rearrange sd_notify() call in become_daemon() to only send status to systemd in this mode (Type=notify is not designed to monitor forking). Drop READY=0 (it does nothing) and MAINPID= (unnecessary because the process spawned by systemd is already the main PID). Also remove STATUS= prefix from debug messages. Signed-off-by: Marcos Mello <marcosfrm@gmail.com> Reviewed-by: Andreas Schneider <asn@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> (cherry picked from commit 440ddf8470b11a46066d282bf8945201d547c192) BUG: https://bugzilla.samba.org/show_bug.cgi?id=11568
* lib:util: Move debug message for mkdir failing to log level 1Andreas Schneider2019-03-121-3/+3
| | | | | | | | | | | | | | If you connnect to a host with smbclient this gets always printed. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13823 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> (cherry picked from commit c71334ec0c92e791022a9b7c900aa0dd649226c2) Autobuild-User(v4-9-test): Karolin Seeger <kseeger@samba.org> Autobuild-Date(v4-9-test): Tue Mar 12 16:13:29 UTC 2019 on sn-devel-144
* CVE-2019-3824 ldb: Release ldb 1.4.6ldb-1.4.6Gary Lockyer2019-02-264-1/+284
| | | | | | | | | | | * CVE-2019-3824 out of bounds read in wildcard compare (bug 13773) BUG: https://bugzilla.samba.org/show_bug.cgi?id=13773 Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Autobuild-User(v4-9-test): Stefan Metzmacher <metze@samba.org> Autobuild-Date(v4-9-test): Tue Feb 26 11:11:42 CET 2019 on sn-devel-144
* CVE-2019-3824 ldb: Add tests for ldb_wildcard_matchGary Lockyer2019-02-263-1/+214
| | | | | | | | | | | | | | Add cmocka tests for ldb_wildcard_match. Running test_wildcard_match under valgrind reproduces CVE-2019-3824 out of bounds read in wildcard compare (bug 13773) valgrind --suppressions=lib/ldb/tests/ldb_match_test.valgrind\ bin/ldb_match_test BUG: https://bugzilla.samba.org/show_bug.cgi?id=13773 Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
* CVE-2019-3824 ldb: wildcard_match end of data checkGary Lockyer2019-02-261-1/+1
| | | | | | | | | | | | ldb_handler_copy and ldb_val_dup over allocate by one and add a trailing '\0' to the data, to make them safe to use the C string functions on. However testing for the trailing '\0' is not the correct way to test for the end of a value, the length should be checked instead. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13773 Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
* CVE-2019-3824 ldb: wildcard_match check tree operationGary Lockyer2019-02-261-0/+5
| | | | | | | | | | | | | Check the operation type of the passed parse tree, and return LDB_INAPPROPRIATE_MATCH if the operation is not LDB_OP_SUBSTRING. A query of "attribute=*" gets parsed as LDB_OP_PRESENT, checking the operation and failing ldb_wildcard_match should help prevent confusion writing tests. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13773 Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
* CVE-2019-3824 ldb: ldb_parse_tree use talloc_zeroGary Lockyer2019-02-261-1/+1
| | | | | | | | | | Initialise the created ldb_parse_tree with talloc_zero, this ensures that it is correctly initialised if inadvertently passed to a function expecting a different operation type. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13773 Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
* CVE-2019-3824 ldb: Improve code style and layout in wildcard processingAndrew Bartlett2019-02-261-3/+5
| | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=13773 Signed-off-by: Andrew Bartlett <abartlet@samba.org>
* CVE-2019-3824 ldb: Extra comments to clarify no pointer wrap in wildcard ↵Andrew Bartlett2019-02-261-2/+23
| | | | | | | | processing BUG: https://bugzilla.samba.org/show_bug.cgi?id=13773 Signed-off-by: Andrew Bartlett <abartlet@samba.org>
* CVE-2019-3824 ldb: Out of bound read in ldb_wildcard_compareLukas Slebodnik2019-02-261-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There is valgrind error in few tests tests/test-generic.sh 91 echo "Test wildcard match" 92 $VALGRIND ldbadd $LDBDIR/tests/test-wildcard.ldif || exit 1 93 $VALGRIND ldbsearch '(cn=test*multi)' || exit 1 95 $VALGRIND ldbsearch '(cn=*test_multi)' || exit 1 97 $VALGRIND ldbsearch '(cn=test*multi*test*multi)' || exit 1 e.g. ==3098== Memcheck, a memory error detector ==3098== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al. ==3098== Using Valgrind-3.14.0 and LibVEX; rerun with -h for copyright info ==3098== Command: ./bin/ldbsearch (cn=test*multi) ==3098== ==3098== Invalid read of size 1 ==3098== at 0x483CEE7: memchr (vg_replace_strmem.c:890) ==3098== by 0x49A9073: memmem (in /usr/lib64/libc-2.28.9000.so) ==3098== by 0x485DFE9: ldb_wildcard_compare (ldb_match.c:313) ==3098== by 0x485DFE9: ldb_match_substring (ldb_match.c:360) ==3098== by 0x485DFE9: ldb_match_message (ldb_match.c:572) ==3098== by 0x558F8FA: search_func (ldb_kv_search.c:549) ==3098== by 0x48C78CA: ??? (in /usr/lib64/libtdb.so.1.3.17) ==3098== by 0x48C7A60: tdb_traverse_read (in /usr/lib64/libtdb.so.1.3.17) ==3098== by 0x557B7C4: ltdb_traverse_fn (ldb_tdb.c:274) ==3098== by 0x558FBFA: ldb_kv_search_full (ldb_kv_search.c:594) ==3098== by 0x558FBFA: ldb_kv_search (ldb_kv_search.c:854) ==3098== by 0x558E497: ldb_kv_callback (ldb_kv.c:1713) ==3098== by 0x48FCD58: tevent_common_invoke_timer_handler (in /usr/lib64/libtevent.so.0.9.38) ==3098== by 0x48FCEFD: tevent_common_loop_timer_delay (in /usr/lib64/libtevent.so.0.9.38) ==3098== by 0x48FE14A: ??? (in /usr/lib64/libtevent.so.0.9.38) ==3098== Address 0x4b4ab81 is 0 bytes after a block of size 129 alloc'd ==3098== at 0x483880B: malloc (vg_replace_malloc.c:309) ==3098== by 0x491048B: talloc_strndup (in /usr/lib64/libtalloc.so.2.1.15) ==3098== by 0x48593CA: ldb_casefold_default (ldb_utf8.c:59) ==3098== by 0x485F68D: ldb_handler_fold (attrib_handlers.c:64) ==3098== by 0x485DB88: ldb_wildcard_compare (ldb_match.c:257) ==3098== by 0x485DB88: ldb_match_substring (ldb_match.c:360) ==3098== by 0x485DB88: ldb_match_message (ldb_match.c:572) ==3098== by 0x558F8FA: search_func (ldb_kv_search.c:549) ==3098== by 0x48C78CA: ??? (in /usr/lib64/libtdb.so.1.3.17) ==3098== by 0x48C7A60: tdb_traverse_read (in /usr/lib64/libtdb.so.1.3.17) ==3098== by 0x557B7C4: ltdb_traverse_fn (ldb_tdb.c:274) ==3098== by 0x558FBFA: ldb_kv_search_full (ldb_kv_search.c:594) ==3098== by 0x558FBFA: ldb_kv_search (ldb_kv_search.c:854) ==3098== by 0x558E497: ldb_kv_callback (ldb_kv.c:1713) ==3098== by 0x48FCD58: tevent_common_invoke_timer_handler (in /usr/lib64/libtevent.so.0.9.38) ==3098== # record 1 dn: cn=test_multi_test_multi_test_multi,o=University of Michigan,c=TEST cn: test_multi_test_multi_test_multi description: test multi wildcards matching objectclass: person sn: multi_test name: test_multi_test_multi_test_multi distinguishedName: cn=test_multi_test_multi_test_multi,o=University of Michiga n,c=TEST # returned 1 records # 1 entries # 0 referrals BUG: https://bugzilla.samba.org/show_bug.cgi?id=13773 Signed-off-by: Lukas Slebodnik <lslebodn@fedoraproject.org>
* ldb: Bump ldb version to 1.4.5ldb-1.4.5Tim Beale2019-02-134-1/+284
| | | | | | | | | | | | * ldb: Avoid inefficient one-level searches BUG: https://bugzilla.samba.org/show_bug.cgi?id=13762 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Signed-off-by: Stefan Metzmacher <metze@samba.org> Autobuild-User(v4-9-test): Stefan Metzmacher <metze@samba.org> Autobuild-Date(v4-9-test): Wed Feb 13 18:26:30 CET 2019 on sn-devel-144
* ldb: Avoid inefficient one-level searchesTim Beale2019-02-131-4/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit 88ae60ed186c9 introduced a problem that made one-level searches inefficient if there were a lot of child objects in the same level, and the requested object didn't exist. Basically, it ignored the case where ldb_kv_index_dn() returned LDB_ERR_NO_SUCH_OBJECT, i.e. the indexed lookup was successful, but didn't find a match. At which point, there was no more processing we needed to do. The behaviour after 88ae60ed186c9 was to fall-through and run the ldb_kv_index_filter() function over *all* the children. This still returned the correct result, but could be costly if there were a lot of children. The case 88ae60ed186c9 was trying to fix was where we could not do an indexed search (e.g. trying to match on a 'attribute=*' filter). In which case we want to ignore the LDB_ERR_OPERATIONS_ERROR and just run ldb_kv_index_filter() over all the children. This is still more efficient than the fallback of doing a full database scan. This patch adds in a short-circuit for the NO_SUCH_OBJECT case, so we can skip the unnecessary ldb_kv_index_filter() work. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13762 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> (Manual merge of commit 9a893f9613bd6440ab in master)
* lib/audit_logging: actually create tallocPhilipp Gesang2019-02-011-0/+6
| | | | | | | | | | | | | | | Heal damage of 79f494e51e.. That context is being passed around and freed but is never actually allocated on that stack. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13737 Signed-off-by: Philipp Gesang <philipp.gesang@intra2net.com> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Jeremy Allison <jra@samba.org> (cherry picked from commit 5c928d7cd1d0ac994fe95892eec235b939ad2ec9)
* audit_logging: Remove debug log header and JSON Authentication: prefixAndrew Bartlett2019-02-012-9/+13
| | | | | | | | | | | | | | | Feedback from real-world users is that they really want raw JSON strings in the log. We can not easily remove the leading " " but the other strings above and before the JSON are really annoying to strip back off BUG: https://bugzilla.samba.org/show_bug.cgi?id=13714 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> (cherry-picked from edab1318f9138c0d87de7cc7cfa5da8e29c906f8 and modified for v4-9 by Gary Lockyer)
* json: Modify API to use return codesGary Lockyer2019-02-013-267/+573
| | | | | | | | | | | | Modify the auditing JSON API to return a response code, as the consensus was that the existing error handling was aesthetically displeasing. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> cherry picked from commit 79f494e51eabb5176747fcf3b9f2efad10ec7f97 and adapted to compile on 4.9 by Gary Lockyer)
* ldb: Bump ldb version to 1.4.4ldb-1.4.4Noel Power2019-01-214-1/+284
| | | | | | | | | | | Python: Ensure ldb.Dn can doesn't rencoded str with py2 (bug 13616) BUG: https://bugzilla.samba.org/show_bug.cgi?id=13616 Signed-off-by: Noel Power <noel.power@suse.com> Autobuild-User(v4-9-test): Karolin Seeger <kseeger@samba.org> Autobuild-Date(v4-9-test): Mon Jan 21 12:55:04 CET 2019 on sn-devel-144
* lib/ldb: Use new PYARG_ES format for parseTupleNoel Power2019-01-211-1/+6
| | | | | | | | | | | | | | | | | | | | | | | | While 'es' format works great for unicode (in python2) and str (in python3) The behaviour with str (in python2) is unexpected. In python2 the str type is (re-encoded) with the specified encoding. In python2 the 'et' type would be a better match, that ensures 'str' type is treated like it was with 's' (no reencoding) and unicode is encoded with the specified encoding. However in python3 'et' allows byte (or bytearray) params to be accepted (with no reencoding), we don't want this. This patch adds a new PYARG_STR_UNI format code which is a hybrid, in python2 it evaluates to 'et' and in python3 'es' and so gives the desired behaviour for each python version. Additionally remove the associated known fail. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13616 Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org> Autobuild-Date(master): Sun Jan 13 03:53:00 CET 2019 on sn-devel-144 (cherry picked from commit 8900e0b4cb05613df9cbeeb8b8253273b06b3c17)
* lib/ldb/tests/python: Add test to pass utf8 encoded bytes to ldb.DnNoel Power2019-01-211-0/+15
| | | | | | | | | | | | | | | This test should demonstrate an error with the 'es' format in python where a 'str' byte-string is passed (containing utf8 encoded bytes) with some characters that cannot be decoded as ascii. The same code if run in python3 should generate an error (needs string not bytes) Also Add knownfail for ldb.Dn passed utf8 encoded byte string BUG: https://bugzilla.samba.org/show_bug.cgi?id=13616 Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> (cherry picked from commit f8758b3b1f98476469501dd45a7c898950294e05)
* lib/util: Count a trailing line that doesn't end in a newlineMartin Schwenke2019-01-092-3/+155
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If the final line of a file does not contain a newline then it isn't included in the line count. Change i to point to the next slot in the array instead of the current one. This means that that the current line won't be thrown away if no newline is seen. Without changing i to unsigned int, the -O3 --picky -developer build fails with: [ 745/4136] Compiling lib/util/util_file.c ==> /builds/samba-team/devel/samba/samba-o3.stderr <== ../../lib/util/util_file.c: In function ‘file_lines_parse’: ../../lib/util/util_file.c:251:8: error: assuming signed overflow does not occur when simplifying conditional to constant [-Werror=strict-overflow] while (i > 0 && ret[i-1][0] == 0) { ^ cc1: all warnings being treated as errors BUG: https://bugzilla.samba.org/show_bug.cgi?id=13717 Signed-off-by: Martin Schwenke <martin@meltin.net> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Wed Dec 19 08:08:28 CET 2018 on sn-devel-144 (cherry picked from commit 5118985841aa0363147d552f243ab5a7d90dbdaf)
* ldb_controls: Add some talloc error checking for controlsGarming Sam2018-12-041-2/+80
| | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=13686 Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> (cherry picked from commit ad8bb6fcd08be28c40f2522d640333e9e69b7852)
* dirsync: Allow arbitrary length cookiesGarming Sam2018-12-041-5/+21
| | | | | | | | | | | | The length of the cookie is proportional to the number of DCs ever in the domain (as it stores the uptodateness vector which has stale invocationID). BUG: https://bugzilla.samba.org/show_bug.cgi?id=13686 Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> (cherry picked from commit b7a0d3b110697923a31e353905d3b1bd9385ea9b)
* lib:util: Fix DEBUGCLASS pointer initializiationAndreas Schneider2018-11-121-2/+2
| | | | | | | | | | | | | | | | | This fixes a segfault in pyglue: ==10142== Process terminating with default action of signal 11 (SIGSEGV) ==10142== Bad permissions for mapped region at address 0x6F00A20 ==10142== at 0x6F1074B: py_set_debug_level (pyglue.c:165) BUG: https://bugzilla.samba.org/show_bug.cgi?id=13679 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> (cherry picked from commit 71ef09c1afdbf967b829cb66b33c3a5cb1c18ba0) Autobuild-User(v4-9-test): Karolin Seeger <kseeger@samba.org> Autobuild-Date(v4-9-test): Mon Nov 12 16:04:51 CET 2018 on sn-devel-144
* ldb: Bump ldb version to 1.4.3ldb-1.4.3Noel Power2018-11-054-1/+284
| | | | | | | | | * Python: Ensure ldb.Dn can accept utf8 encoded unicode (bug 13616) BUG: https://bugzilla.samba.org/show_bug.cgi?id=13616 Signed-off-by: Noel Power <noel.power@suse.com> Signed-off-by: Andrew Bartlett <abartlet@samba.org>
* lib/ldb: Ensure ldb.Dn can accept utf8 encoded unicodeNoel Power2018-11-051-13/+17
| | | | | | | | | Additionally remove the associated known fail. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13616 Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org> (cherry picked from commit cddd54e8654c94dedd57c08af1987ce03212ce20)
* lib/ldb/tests: add test for ldb.Dn passed utf8 unicodeNoel Power2018-11-051-0/+4
| | | | | | | | | | | | | | object dn format should be a utf8 encoded string Note: Currently this fails in python2 as the c python binding for the dn string param uses PyArg_ParseTupleAndKeywords() with 's' format, this will accept str *or* unicode in the default encoding. The default encoding in python2 is... ascii. Also adding here a knownfail to squash the error produced by the test. Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org> (cherry picked from commit d1492ab919b19d1ca72f1d7c97ac0ca3bee13a2a)
* lib/ldb: Test correct variable for no mem conditionNoel Power2018-11-051-1/+1
| | | | | | Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org> (cherry picked from commit d786e1fca95395e793867278bc0408e33c19908b)
* lib:socket: If returning early, set ifacesDavid Mulder2018-11-051-1/+2
| | | | | | | | | | | | | | | | | Prevents a segfault in load_interfaces() when total interfaces == 1. Fixes regression caused by da68a1b2f417ec82ea4ed3e7a4d867cef8ca8f93. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13665 Signed-off-by: David Mulder <dmulder@suse.com> Reviewed-by: Ralph Böhme <slow@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Volker Lendecke <vl@samba.org> Autobuild-Date(master): Sun Oct 28 00:35:35 CEST 2018 on sn-devel-144 (cherry picked from commit 5391e21dea3168691cee1e6ef6c5959e46d62d1e)
* lib: Avoid the use of open_memstream in tevent_req_profile_stringVolker Lendecke2018-10-103-57/+51
| | | | | | | | | | | | Solaris does not have it. Bug: https://bugzilla.samba.org/show_bug.cgi?id=13629 Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> (cherry picked from commit e7d3678ddb5916416193d553f3cc562627e7d8ab) Autobuild-User(v4-9-test): Karolin Seeger <kseeger@samba.org> Autobuild-Date(v4-9-test): Wed Oct 10 18:57:59 CEST 2018 on sn-devel-144
* krb5-samba: interdomain trust uses different salt principalAlexander Bokovoy2018-09-052-17/+46
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Salt principal for the interdomain trust is krbtgt/DOMAIN@REALM where DOMAIN is the sAMAccountName without the dollar sign ($) The salt principal for the BLA$ user object was generated wrong. dn: CN=bla.base,CN=System,DC=w4edom-l4,DC=base securityIdentifier: S-1-5-21-4053568372-2049667917-3384589010 trustDirection: 3 trustPartner: bla.base trustPosixOffset: -2147483648 trustType: 2 trustAttributes: 8 flatName: BLA dn: CN=BLA$,CN=Users,DC=w4edom-l4,DC=base userAccountControl: 2080 primaryGroupID: 513 objectSid: S-1-5-21-278041429-3399921908-1452754838-1597 accountExpires: 9223372036854775807 sAMAccountName: BLA$ sAMAccountType: 805306370 pwdLastSet: 131485652467995000 The salt stored by Windows in the package_PrimaryKerberosBlob (within supplementalCredentials) seems to be 'W4EDOM-L4.BASEkrbtgtBLA' for the above trust and Samba stores 'W4EDOM-L4.BASEBLA$'. While the salt used when building the keys from trustAuthOutgoing/trustAuthIncoming is 'W4EDOM-L4.BASEkrbtgtBLA.BASE', which we handle correct. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13539 Pair-Programmed-With: Stefan Metzmacher <metze@samba.org> Signed-off-by: Alexander Bokovoy <ab@samba.org> Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Wed Sep 5 03:57:22 CEST 2018 on sn-devel-144 (cherry picked from commit f3e349bebc443133fdbe4e14b148ca8db8237060) Autobuild-User(v4-9-test): Karolin Seeger <kseeger@samba.org> Autobuild-Date(v4-9-test): Wed Sep 5 15:40:53 CEST 2018 on sn-devel-144
* s3: util: Do not take over stderr when there is no log filePaulo Alcantara2018-09-041-2/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In case we don't have either a /var/log/samba directory, or pass a non-existent log directory through '-l' option, all commands that are daemonized with '-D' option hang when executed within a subshell. An example on how to trigger that: # rm -r /var/log/samba # s=$(nmbd -D -s /etc/samba/smb.conf -l /foo123) (never returns) So, when the above command is executed within a subshell the following happens: (a) Parent shell creates a pipe, sets write side of it to fd 1 (stdout), call read() on read-side fd, forks off a new child process and then executes nmbd in it. (b) nmbd sets up initial logging to go through fd 1 (stdout) by calling setup_logging(..., DEBUG_DEFAULT_STDOUT). 'state.fd' is now set to 1. (c) reopen_logs() is called by the first time which then calls reopen_logs_internal() (d) in reopen_logs_internal(), it attempts to create log.nmbd file in /foo123 directory and fails because directory doesn't exist. (e) Regardless whether the log file was created or not, it calls dup2(state.fd, 2) which dups fd 1 into fd 2. (f) At some point, fd 0 and 1 are closed and set to /dev/null The problem with that is because parent shell in (a) is still blocked in read() call and the new write side of the pipe is now fd 2 -- after dup2() in (e) -- and remains unclosed. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13578 Signed-off-by: Paulo Alcantara <palcantara@suse.de> Reviewed-by: Jim McDonough <jmcd@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Sat Aug 18 01:32:25 CEST 2018 on sn-devel-144 (cherry picked from commit 41aa55f49233ea7682cf14e5a7062617274434ce)
* Release LDB 1.4.2 for CVE-2018-1140ldb-1.4.2Andrew Bartlett2018-08-144-1/+284
| | | | | | | | * Security fix for CVE-2018-1140 (NULL pointer de-reference, bug 13374) * Fix memory leaks and missing error checks (bug 13459, 13471, 13475) Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* CVE-2018-1140 ldb: Add tests for search add and rename with a bad dn= DNAndrew Bartlett2018-08-141-0/+156
| | | | | | Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> BUG: https://bugzilla.samba.org/show_bug.cgi?id=13374
View Lorry Controller Status