summaryrefslogtreecommitdiff
path: root/librpc
Commit message (Collapse)AuthorAgeFilesLines
* librpc/rpc: allow smb3_sid_parse() to accept modern encryption algorithmsStefan Metzmacher2023-05-171-1/+6
| | | | | | | | | | | | | We should not limit the possible encryption algorithms to the currently known ones. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15374 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org> Autobuild-User(master): Volker Lendecke <vl@samba.org> Autobuild-Date(master): Wed May 17 07:34:28 UTC 2023 on atb-devel-224
* rpc_server3: Pass winbind_env_set() state through to rpcd_*Volker Lendecke2023-05-162-0/+18
| | | | | | | | | | | | | | | | Winbind can ask rpcd_lsad for LookupNames etc. This can recurse back into winbind for getpwnam. We have the "_NO_WINBINDD" environment variable set in winbind itself for this case, but this is lost on the way into rpcd_lsad. Use a flag in global_sid_Samba_NPA_Flags to pass this information to dcerpc_core, where it sets the variable on every call if requested. Bug: https://bugzilla.samba.org/show_bug.cgi?id=15361 Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Autobuild-User(master): Volker Lendecke <vl@samba.org> Autobuild-Date(master): Tue May 16 11:54:32 UTC 2023 on atb-devel-224
* rpc: Remove named_pipe_auth_req_info6->need_idle_serverVolker Lendecke2023-05-161-5/+4
| | | | | | | | Involves bumping up the version number Bug: https://bugzilla.samba.org/show_bug.cgi?id=15361 Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* librpc: Simplify dcerpc_is_transport_encrypted()Volker Lendecke2023-05-161-15/+10
| | | | | | | | Simplify logic by using security_token_count_flag_sids() Bug: https://bugzilla.samba.org/show_bug.cgi?id=15361 Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* librpc: Always call ndr_push_compression_state_init() for compressionAndrew Bartlett2023-05-054-33/+50
| | | | | | | | | | | | | | | | | | This allows the push routine to cache the chosen compression algorithm in the struct ndr_compression_state in ndr->cstate and so, in claims, avoid calling ndr_size_CLAIMS_SET_NDR() three times per compression (more in the overall push). As claims is now the primary use of the libndr compression code, this is a reasonable tradeoff compared to the other callers who have more static algorithm selections. By removing the struct ndr_compression_state **state argument from ndr_push_compression_state_init() we make clear that the ndr->cstate belongs to this NDR context, and this context alone. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
* librpc: Fix talloc hierarchy for ndr_compression_stateAndrew Bartlett2023-05-052-59/+7
| | | | | | | | | | | | | | The complexity of generic_mszip_free() is not needed, nor is a talloc destructor required if the memory is correctly created in a tree. Credit to OSS-Fuzz for showing the use-after-free REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57608 BUG: https://bugzilla.samba.org/show_bug.cgi?id=15349 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
* libndr: Handle allocation failureJoseph Sutton2023-04-121-0/+3
| | | | | | | If a talloc function returns NULL, indicating failure, the failure could be masked by the next talloc call allocating on the NULL context. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
* librpc/ndr: Add missing newlines to error messagesJoseph Sutton2023-04-121-3/+3
| | | | Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
* librpc/ndr: Fix NULL pointer dereferenceJoseph Sutton2023-04-051-1/+7
| | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=15348 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* librpc/ndr: Use libndr compression for claimsAndrew Bartlett2023-03-314-8/+156
| | | | | | | | | This ensures our python layer and C layer (in the KDC, when implementated) use the same compression logic and so allows us to test the production compression via the IDL-generated interfaces. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* librpc/ndr: Make ndr_push_compression_state_free() a talloc destructorAndrew Bartlett2023-03-313-23/+20
| | | | | | | This means that the generic_mszip_free() will still be called on failure. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* librpc/ndr: Implement lzxpress_huffman() compression in libndr for Kerberos ↵Andrew Bartlett2023-03-312-6/+149
| | | | | | | | | | | | | Claims Rather than just pick the next value we re-arrange compression values in libndr to be memnonic to values in MS Windows ntifs.h This helps avoid confusing developers who compare these algorithms with local the MS Windows interface. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* librpc/ndr: Add a "NONE" compression format to libndrAndrew Bartlett2023-03-312-0/+71
| | | | | Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* libndr/ndr: Remove unused argument from ndr_push_compression_{start,end}()Andrew Bartlett2023-03-314-26/+22
| | | | | | | | Removing the unused arguments avoids thier value being calculated in the PIDL generated code, which can be expensive. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* libndr/ndr: Add NDR_COMPRESSION_INVALIDAndrew Bartlett2023-03-311-0/+1
| | | | | | | | | This will help make a mapping from wire-specified compression algorithms to our available choices safer by allowing an invalid choice to map to NDR_COMPRESSION_INVALID Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* librpc/ndr: Unimplement DRSUAPI_COMPRESSION_TYPE_XPRESS and renameAndrew Bartlett2023-03-313-18/+19
| | | | | | | | | | | DRSUAPI_COMPRESSION_TYPE_XPRESS is not MS-XCA nor is it implemented by lzexpress_compress(), so disconnect from that algorithm. This avoids someone fixing lzxpress_compress() to work for DRSUAPI and breaking claims support. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* librpc/ndr: Remove incorrect comment that ndr_compression.h is autogeneratedAndrew Bartlett2023-03-311-2/+0
| | | | | Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* librpc: Remove incorrect NDR_COMPRESSION dependency from NDR_KRB5CCACHEAndrew Bartlett2023-03-311-1/+1
| | | | | Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* ndrdump: Allow a long string of hexidecimal digits as well as a hex dump for ↵Andrew Bartlett2023-03-311-0/+2
| | | | | | | --hex-input Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* librpc/idl: Explain why PAC_TYPE_CLIENT_CLAIMS_INFO is not directly decodedAndrew Bartlett2023-03-311-0/+8
| | | | | Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* s4:kdc: Refactor PAC handlingJoseph Sutton2023-03-201-0/+8
| | | | | | | | | | | | | | | | | | It's getting unwieldy adding new PAC buffer types when each one has to have its own handling. It also makes the possibility of mistakes more likely. Add a new container, 'struct pac_blobs', containing the types of PAC buffers in a given PAC, with an index for quick access to the types we support specifically. We can add new blobs (overriding existing ones) by calling pac_blobs_add_blob(), and override certain blobs that must be present with pac_blobs_replace_existing(). This removes the need to have a complicated 'switch' statement with different logic for each PAC buffer type, or a dozen index variables. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* librpc: Simplify dcerpc_default_transport_endpoint()Volker Lendecke2023-03-091-1/+1
| | | | | | | We don't need strcmp for just 1 byte Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* auth: Make more liberal use of SID index constantsJoseph Sutton2023-02-081-4/+4
| | | | | | | | | | | Arrays of SIDs are handled not fully consistently throughout the codebase. Sometimes SIDs in the first and second positions represent a user and a primary group respectively; other times they don't mean anything in particular. Using these index constants in situations of the former sort can help to clarify our intent. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth: Shorten long SID flags combinationsJoseph Sutton2023-02-081-0/+5
| | | | | | | | | The combination MANDATORY | ENABLED_BY_DEFAULT | ENABLED is very commonly used, and introducing a shorter alias for it makes the code clearer. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:kdc: Add resource SID compressionJoseph Sutton2023-02-082-4/+13
| | | | | | | | | | | | | The domain-local groups that are added to the PAC of a service ticket are now, if the service doesn't disclaim support for SID compression, placed into the resource groups structure in PAC_LOGON_INFO. In a TGS exchange directed to a KDC, rather than to a service, the resource groups structure is simply copied into the updated PAC without any processing being done. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth: Pass through entire PAC flags value in auth_user_infoJoseph Sutton2023-02-081-1/+5
| | | | | | | | | | Besides the NETLOGON_GUEST bit indicating whether the user has been authenticated, we now carry all of the other bits as well. This lets us match Windows' behaviour of simply passing these bits through to an updated PAC when processing a TGS-REQ. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* named_pipe_auth: Bump info5 to info6Joseph Sutton2023-02-081-4/+4
| | | | | | | | | In the next commit, we shall replace the 'authenticated' field of named_pipe_auth_req_info.info5.session_info.session_info.info with a more general 'user_flags' field. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth: Exclude resource groups from a TGTJoseph Sutton2023-02-081-0/+9
| | | | | | | | | | Resource group SIDs should only be placed into a service ticket, but we were including them in all tickets. Now that we have access to the group attributes, we'll filter out any groups with SE_GROUP_RESOURCE set if we're creating a TGT. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth: Store group attributes in auth_user_info_dcJoseph Sutton2023-02-081-2/+2
| | | | | | | | | | | | | | | | Group expansion, performed in dsdb_expand_nested_groups(), now incorporates a check of the type of each group. Those that are resource groups receive the SE_GROUP_RESOURCE bit in the attributes which are now carried alongside each group SID. Whereas before, in auth_convert_user_info_dc_sambaseinfo() and auth_convert_user_info_dc_saminfo6(), we invariantly used the flag combination SE_GROUP_MANDATORY | SE_GROUP_ENABLED_BY_DEFAULT | SE_GROUP_ENABLED to set attributes in the PAC, we now take the correct attributes from user_info_dc. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth.idl: Add auth_SidAttr typeJoseph Sutton2023-02-081-0/+5
| | | | | | | | | | | This type incorporates, alongside a SID, a group attributes member, through which attributes from a PAC or the AD database can be conveyed into the completed PAC. A useful benefit this provides is the ability to distinguish and exclude domain-local groups, which only belong in service tickets, from the PAC of a TGT. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* lib: Remove idtree from samba_util.hVolker Lendecke2023-01-101-0/+1
| | | | | | | No need to recompile the world when only a few files need this. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* CVE-2022-38023 s3:rpc_server/netlogon: Use dcesrv_netr_creds_server_step_check()Samuel Cabrero2023-01-091-6/+0
| | | | | | | | After s3 and s4 rpc servers merge we can avoid duplicated code. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15240 Signed-off-by: Samuel Cabrero <scabrero@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* CVE-2022-38023 s4:rpc_server/netlogon: Move schannel and credentials check ↵Samuel Cabrero2023-01-093-0/+642
| | | | | | | | | | functions to librpc Will be used later by s3 netlogon server. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15240 Signed-off-by: Samuel Cabrero <scabrero@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* winbindd: add dcname arg to ChangeMachineAccount requestRalph Boehme2022-12-211-0/+1
| | | | | | | | Existing callers will pass an empty string, later a new caller will pass an explicit DC name taken from the wbinfo command line. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* smbd: Remove source3/smbd/statcache.cVolker Lendecke2022-12-141-1/+1
| | | | | | | | After I found that nobody calls stat_cache_add() anymore, there was no reason to keep the rest of statcache.c. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* CVE-2022-37966 drsuapi.idl: add trustedDomain related ATTID valuesStefan Metzmacher2022-12-131-0/+9
| | | | | | | | | | | | | For now this is only for debugging in order to see DRSUAPI_ATTID_msDS_SupportedEncryptionTypes in the replication meta data. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15219 BUG: https://bugzilla.samba.org/show_bug.cgi?id=15237 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* CVE-2022-37966 kdc: Implement new Kerberos session key behaviour since ↵Andrew Bartlett2022-12-131-0/+1
| | | | | | | | | | | | | | | | | ENC_HMAC_SHA1_96_AES256_SK was added ENC_HMAC_SHA1_96_AES256_SK is a flag introduced for by Microsoft in this CVE to indicate that additionally, AES session keys are available. We set the etypes available for session keys depending on the encryption types that are supported by the principal. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15219 Pair-Programmed-With: Joseph Sutton <josephsutton@catalyst.net.nz> Signed-off-by: Andrew Bartlett <abartlet@samba.org> Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* CVE-2022-37966 param: Add support for new option "kdc default domain ↵Joseph Sutton2022-12-131-0/+1
| | | | | | | | | | | | | | | | supportedenctypes" This matches the Windows registry key HKEY_LOCAL_MACHINE\System\CurrentControlSet\services\KDC\DefaultDomainSupportedEncTypes BUG: https://bugzilla.samba.org/show_bug.cgi?id=15237 Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org> Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* CVE-2022-37967 Add new PAC checksumJoseph Sutton2022-12-131-1/+3
| | | | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=15231 Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org> Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* idl: Fix whitespaceVolker Lendecke2022-11-221-2/+2
| | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* librpc/ndr: Fix incorrect error string in SID parserJoseph Sutton2022-10-211-1/+1
| | | | | Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* CVE-2020-25720: s4-acl: Owner no longer has implicit Write DACLNadezhda Ivanova2022-09-161-0/+9
| | | | | | | | | | | The implicit right of an object's owner to modify its security descriptor no longer exists, according to the new access rules. However, we continue to grant this implicit right for fileserver access checks. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14810 Signed-off-by: Nadezhda Ivanova <nivanova@symas.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* krb5pac.idl: Add definitions for claims PAC buffersJoseph Sutton2022-09-091-0/+23
| | | | | | | | The PAC device info definition comes from [MS-PAC] 2.12. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* claims.idl: Add claim type definitionsJoseph Sutton2022-09-094-2/+201
| | | | | | Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* librpc: Simplify ndr_size_dom_sid28()Volker Lendecke2022-09-071-2/+1
| | | | | | | Don't duplicate the calculation Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* librpc: Simplify ndr_size_dom_sid28()Volker Lendecke2022-09-071-2/+0
| | | | | | | all_zero() treats a NULL pointer as true. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* smbXsrv_client: notify a different node to drop a connection by client guid.Stefan Metzmacher2022-09-021-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | If a client disconnected all its interfaces and reconnects when the come back, it will likely start from any ip address returned dns, which means it can try to connect to a different ctdb node. The old node may not have noticed the disconnect and still holds the client_guid based smbd. Up unil now the new node returned NT_STATUS_NOT_SUPPORTED to the SMB2 Negotiate request, as messaging_send_iov[_from]() will return -1/ENOSYS if a file descriptor os passed to a process on a different node. Now we tell the other node to teardown all client connections belonging to the client-guid. Note that this is not authenticated, but if an attacker can capture the client-guid, he can also inject TCP resets anyway, to get the same effect. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15159 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Fri Sep 2 20:59:15 UTC 2022 on sn-devel-184
* samr.idl: Add samr_ChangePasswordUser4()Andreas Schneider2022-07-281-0/+34
| | | | Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* samr:idl: add samr_SupportedFeatures for samr_Connect5()Andreas Schneider2022-07-281-1/+8
| | | | Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* samr.idl: Add support for new AES encrypted password bufferAndreas Schneider2022-07-281-1/+23
| | | | Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
View Lorry Controller Status