summaryrefslogtreecommitdiff
path: root/source4/dsdb
Commit message (Collapse)AuthorAgeFilesLines
* dsdb:repl_meta_data: allow CONTROL_DBCHECK_FIX_LINK_DN_NAME to by pass renameStefan Metzmacher2019-03-281-0/+7
| | | | | | | | | | | We need a way to rename an object without updating the replication meta data. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13816 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> (cherry picked from commit 3e8a435d27da899d0e3dab7cbc0a1c738067eba3)
* dsdb: Add comments explaining the limitations of our current backlink behaviourAndrew Bartlett2018-11-052-7/+35
| | | | | | | | | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=13418 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Tim Beale <timbeale@catalyst.net.nz> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Tue Oct 30 10:32:51 CET 2018 on sn-devel-144 (cherry picked from commit 852e1db12b0afa04a738c03bb2609c084fe96a7f) Autobuild-User(v4-8-test): Karolin Seeger <kseeger@samba.org> Autobuild-Date(v4-8-test): Mon Nov 5 14:28:49 CET 2018 on sn-devel-144
* s4:samldb: internally use extended dns while changing the primaryGroupID fieldStefan Metzmacher2018-11-051-8/+21
| | | | | | | | | | | This is important, otherwise we'll loose the <SID=> component of the linked attribute. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13418 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> (cherry picked from commit 7a36cb30b716d56b84e894851c1a18e9eb3a0964)
* s4:repl_meta_data: add support for DSDB_CONTROL_DBCHECK_FIX_LINK_DN_SIDStefan Metzmacher2018-11-053-3/+161
| | | | | | | | | | This will be used by dbcheck in the next commits. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13418 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> (cherry picked from commit 0386307e34097f5d9233c970983c7306d1705a87)
* s4:repl_meta_data: pass down struct replmd_replicated_request to ↵Stefan Metzmacher2018-11-051-19/+12
| | | | | | | | | | | | replmd_modify_la_replace() This will simplify further changes. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13418 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> (cherry picked from commit 1ef145d9d72d847055f6aba8a0070b3e1cfdabbc)
* s4:repl_meta_data: pass down struct replmd_replicated_request to ↵Stefan Metzmacher2018-11-051-16/+11
| | | | | | | | | | | | replmd_modify_la_delete() This will simplify further changes. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13418 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> (cherry picked from commit 738b52eb0856c8fcdbb8589e8061bcc14700c23a)
* s4:repl_meta_data: add missing \n to a DEBUG message in replmd_modify_la_add()Stefan Metzmacher2018-11-051-1/+1
| | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=13418 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> (cherry picked from commit 70a306d0bd6806d1fd00d45e3d8cc70c73d09f79)
* s4:repl_meta_data: pass down struct replmd_replicated_request to ↵Stefan Metzmacher2018-11-051-17/+10
| | | | | | | | | | | | replmd_modify_la_add() This will simplify further changes. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13418 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> (cherry picked from commit 42e69a86ca583e3cb20c63b9c6930b4b3425485d)
* s4:repl_meta_data: pass down struct replmd_replicated_request to ↵Stefan Metzmacher2018-11-051-15/+10
| | | | | | | | | | | | replmd_modify_handle_linked_attribs() This will simplify further changes. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13418 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> (cherry picked from commit 966c7febaf0245516481bde924ea6cd738eeb78b)
* s4:dsdb: add DSDB_CONTROL_DBCHECK_FIX_LINK_DN_SID oidStefan Metzmacher2018-11-052-0/+4
| | | | | | | | | | This will be used to fix missing <SID=> components in future. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13418 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> (cherry picked from commit bb9c9e49a5e82f19626cb1b12ec9189fff5114e8)
* s4:dsdb: fix comment on DSDB_CONTROL_DBCHECK_FIX_LINK_DN_NAMEStefan Metzmacher2018-11-051-1/+1
| | | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> (cherry picked from commit 60131b4452d43b3792e7f27a4190c88e7aabb1b4)
* dbchecker: Fixing up incorrect DNs wasn't workingTim Beale2018-11-053-0/+68
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | dbcheck would fail to fix up attributes where the extended DN's GUID is correct, but the DN itself is incorrect. The code failed attempting to remove the old/incorrect DN, e.g. NOTE: old (due to rename or delete) DN string component for objectCategory in object CN=alice,CN=Users,DC=samba,DC=example,DC=com - <GUID=7bfdf9d8-62f9-420c-8a71-e3d3e931c91e>; CN=Person,CN=Schema,CN=Configuration,DC=samba,DC=bad,DC=com Change DN to <GUID=7bfdf9d8-62f9-420c-8a71-e3d3e931c91e>; CN=Person,CN=Schema,CN=Configuration,DC=samba,DC=example,DC=com? [y/N/all/none] y Failed to fix old DN string on attribute objectCategory : (16, "attribute 'objectCategory': no matching attribute value while deleting attribute on 'CN=alice,CN=Users,DC=samba,DC=example,DC=com'") The problem was the LDB message specified the value to delete with its full DN, including the GUID. The LDB code then helpfully corrected this value on the way through, so that the DN got updated to reflect the correct DN (i.e. 'DC=example,DC=com') of the object matching that GUID, rather than the incorrect DN (i.e. 'DC=bad,DC=com') that we were trying to remove. Because the requested value and the existing DB value didn't match, the operation failed. We can avoid this problem by passing down just the DN (not the extended DN) of the value we want to delete. Without the GUID portion of the DN, the LDB code will no longer try to correct it on the way through, and the dbcheck operation will succeed. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13495 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> Pair-programmed-with: Andrew Bartlett <abartlet@samba.org> (cherry picked from commit 22208f52e6096fbe9413b8ff339d9446851e0874)
* dbcheck: Use symbolic control name for DSDB_CONTROL_DBCHECK_FIX_DUPLICATE_LINKSAndrew Bartlett2018-11-051-0/+1
| | | | | | | | | While we do not wish to encourage use of this control, manually typed OIDs are even more trouble, so pass out via pydsdb. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> (cherry picked from commit c7fd68088d84232a2f4074ca278b5448ef624afd)
* krb5-samba: interdomain trust uses different salt principalAlexander Bokovoy2018-09-051-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Salt principal for the interdomain trust is krbtgt/DOMAIN@REALM where DOMAIN is the sAMAccountName without the dollar sign ($) The salt principal for the BLA$ user object was generated wrong. dn: CN=bla.base,CN=System,DC=w4edom-l4,DC=base securityIdentifier: S-1-5-21-4053568372-2049667917-3384589010 trustDirection: 3 trustPartner: bla.base trustPosixOffset: -2147483648 trustType: 2 trustAttributes: 8 flatName: BLA dn: CN=BLA$,CN=Users,DC=w4edom-l4,DC=base userAccountControl: 2080 primaryGroupID: 513 objectSid: S-1-5-21-278041429-3399921908-1452754838-1597 accountExpires: 9223372036854775807 sAMAccountName: BLA$ sAMAccountType: 805306370 pwdLastSet: 131485652467995000 The salt stored by Windows in the package_PrimaryKerberosBlob (within supplementalCredentials) seems to be 'W4EDOM-L4.BASEkrbtgtBLA' for the above trust and Samba stores 'W4EDOM-L4.BASEBLA$'. While the salt used when building the keys from trustAuthOutgoing/trustAuthIncoming is 'W4EDOM-L4.BASEkrbtgtBLA.BASE', which we handle correct. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13539 Pair-Programmed-With: Stefan Metzmacher <metze@samba.org> Signed-off-by: Alexander Bokovoy <ab@samba.org> Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Wed Sep 5 03:57:22 CEST 2018 on sn-devel-144 (cherry picked from commit f3e349bebc443133fdbe4e14b148ca8db8237060) Autobuild-User(v4-8-test): Stefan Metzmacher <metze@samba.org> Autobuild-Date(v4-8-test): Wed Sep 5 18:32:05 CEST 2018 on sn-devel-144
* s4:dsdb/common: add samdb_domain_guid() helper functionStefan Metzmacher2018-09-051-0/+55
| | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=11517 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> (cherry picked from commit 0e442e094240abbf79aaca00a9d1a053a200a7e8)
* dsdb:util_trusts: add dsdb_trust_local_tdo_info() helper functionStefan Metzmacher2018-09-051-0/+16
| | | | | | | | | | | This is similar to dsdb_trust_xref_tdo_info(), but will also work if we ever support more than one domain in our forest. BUG: https://bugzilla.samba.org/show_bug.cgi?id=11517 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> (cherry picked from commit c1b0ac95db5c6112d90356c7ada8c3d445e9b668)
* dsdb/util_trusts: domain_dn is an input parameter of ↵Stefan Metzmacher2018-09-051-6/+0
| | | | | | | | | | | | | | dsdb_trust_crossref_tdo_info() We should not overwrite it within the function. Currently it doesn't matter as we don't have multiple domains within our forest, but that will change in future. BUG: https://bugzilla.samba.org/show_bug.cgi?id=11517 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> (cherry picked from commit f5f96f558b499770cdeb3d38998167a387e058b9)
* CVE-2018-10919 tests: Add extra test for dirsync deleted object corner-caseTim Beale2018-08-111-26/+131
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The acl_read.c code contains a special case to allow dirsync to work-around having insufficient access rights. We had a concern that the dirsync module could leak sensitive information for deleted objects. This patch adds a test-case to prove whether or not this is happening. The new test case is similar to the existing dirsync test except: - We make the confidential attribute also preserve-on-delete, so it hangs around for deleted objcts. Because the attributes now persist across test case runs, I've used a different attribute to normal. (Technically, the dirsync search expressions are now specific enough that the regular attribute could be used, but it would make things quite fragile if someone tried to add a new test case). - To handle searching for deleted objects, the search expressions are now more complicated. Currently dirsync adds an extra-filter to the '!' searches to exclude deleted objects, i.e. samaccountname matches the test-objects AND the object is not deleted. We now extend this to include deleted objects with lastKnownParent equal to the test OU. The search expression matches either case so that we can use the same expression throughout the test (regardless of whether the object is deleted yet or not). This test proves that the dirsync corner-case does not actually leak sensitive information on Samba. This is due to a bug in the dirsync code - when the buggy line is removed, this new test promptly fails. Test also passes against Windows. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13434 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
* CVE-2018-10919 acl_read: Fix unauthorized attribute access via searchesTim Beale2018-08-111-0/+247
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A user that doesn't have access to view an attribute can still guess the attribute's value via repeated LDAP searches. This affects confidential attributes, as well as ACLs applied to an object/attribute to deny access. Currently the code will hide objects if the attribute filter contains an attribute they are not authorized to see. However, the code still returns objects as results if confidential attribute is in the search expression itself, but not in the attribute filter. To fix this problem we have to check the access rights on the attributes in the search-tree, as well as the attributes returned in the message. Points of note: - I've preserved the existing dirsync logic (the dirsync module code suppresses the result as long as the replPropertyMetaData attribute is removed). However, there doesn't appear to be any test that highlights that this functionality is required for dirsync. - To avoid this fix breaking the acl.py tests, we need to still permit searches like 'objectClass=*', even though we don't have Read Property access rights for the objectClass attribute. The logic that Windows uses does not appear to be clearly documented, so I've made a best guess that seems to mirror Windows behaviour. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13434 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
* CVE-2018-10919 acl_read: Flip the logic in the dirsync checkTim Beale2018-08-111-10/+7
| | | | | | | | | This better reflects the special case we're making for dirsync, and gets rid of a 'if-else' clause. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13434 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
* CVE-2018-10919 acl_read: Small refactor to aclread_callback()Tim Beale2018-08-111-14/+17
| | | | | | | | | Flip the dirsync check (to avoid a double negative), and use a helper boolean variable. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13434 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
* CVE-2018-10919 acl_read: Split access_mask logic out into helper functionTim Beale2018-08-111-19/+35
| | | | | | | | So we can re-use the same logic laster for checking the search-ops. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13434 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
* CVE-2018-10919 tests: test ldap searches for non-existent attributes.Gary Lockyer2018-08-111-0/+9
| | | | | | | | | It is perfectly legal to search LDAP for an attribute that is not part of the schema. That part of the query should simply not match. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13434 Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
* CVE-2018-10919 tests: Add test case for object visibility with limited rightsTim Beale2018-08-111-0/+68
| | | | | | | | | | | | | | | | | | | Currently Samba is a bit disclosive with LDB_OP_PRESENT (i.e. attribute=*) searches compared to Windows. All the acl.py tests are based on objectClass=* searches, where Windows will happily tell a user about objects they have List Contents rights, but not Read Property rights for. However, if you change the attribute being searched for, suddenly the objects are no longer visible on Windows (whereas they are on Samba). This is a problem, because Samba can tell you about which objects have confidential attributes, which in itself could be disclosive. This patch adds a acl.py test-case that highlights this behaviour. The test passes against Windows but fails against Samba. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
* CVE-2018-10919 tests: Add tests for guessing confidential attributesTim Beale2018-08-111-0/+920
| | | | | | | | | | | | | | | | | | | | | Adds tests that assert that a confidential attribute cannot be guessed by an unprivileged user through wildcard DB searches. The tests basically consist of a set of DB searches/assertions that get run for: - basic searches against a confidential attribute - confidential attributes that get overridden by giving access to the user via an ACE (run against a variety of ACEs) - protecting a non-confidential attribute via an ACL that denies read- access (run against a variety of ACEs) - querying confidential attributes via the dirsync controls These tests all pass when run against a Windows Dc and all fail against a Samba DC. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13434 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
* CVE-2018-10918: cracknames: Fix DoS (NULL pointer de-ref) when not ↵Andrew Bartlett2018-08-111-1/+7
| | | | | | | | | | | | | | servicePrincipalName is set on a user This regression was introduced in Samba 4.7 by bug 12842 and in master git commit eb2e77970e41c1cb62c041877565e939c78ff52d. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13552 CVE-2018-10918: Denial of Service Attack on AD DC DRSUAPI server. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* samdb: Fix build error with gcc8Andreas Schneider2018-06-261-1/+1
| | | | | | | | | | | | | | | | | | | ../source4/dsdb/samdb/ldb_modules/samldb.c: In function ‘samldb_add’: ../source4/dsdb/samdb/ldb_modules/samldb.c:424:6: error: ‘found’ may be used uninitialized in this function [-Werror=maybe-uninitialized] if (found) { ^ ../source4/dsdb/samdb/ldb_modules/samldb.c:348:11: note: ‘found’ was declared here bool ok, found; ^~~~~ BUG: https://bugzilla.samba.org/show_bug.cgi?id=13437 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Guenther Deschner <gd@samba.org> (cherry picked from commit 76828876faa3cd463023e323983df0be597c7361) Autobuild-User(v4-8-test): Karolin Seeger <kseeger@samba.org> Autobuild-Date(v4-8-test): Tue Jun 26 02:26:15 CEST 2018 on sn-devel-144
* dsdb: Fix CID 1034966 Uninitialized scalar variableVolker Lendecke2018-04-101-0/+1
| | | | | | | | | | | | "continue" in a do-while loop jumps to the "while"-check, so "id_exists" needs to be initialized by that point. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13367 Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> (cherry picked from commit 925d1f23291c4bdbc832977b2b4577964b8301c8)
* Fix invocation of gnutls_aead_cipher_encrypt()Timur I. Bakeyev2018-04-061-3/+3
| | | | | | | | | | | | | | | | Which was failing with GNUTLS_E_SHORT_MEMORY_BUFFER - The given memory buffer is too short to hold parameters. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13352 Signed-off-by: Timur I. Bakeyev <timur@iXsystems.com> Reviewed-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> Autobuild-User(master): Garming Sam <garming@samba.org> Autobuild-Date(master): Fri Mar 23 07:25:30 CET 2018 on sn-devel-144 (cherry picked from commit b9f0c7f93c058685e24d104432978bd40b94b49f)
* CVE-2018-1057: s4:dsdb/acl: changing dBCSPwd is only allowed with a controlRalph Boehme2018-03-131-1/+10
| | | | | | | | | | This is not strictly needed to fig bug 13272, but it makes sense to also fix this while fixing the overall ACL checking logic. Bug: https://bugzilla.samba.org/show_bug.cgi?id=13272 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* CVE-2018-1057: s4:dsdb: use DSDB_CONTROL_PASSWORD_ACL_VALIDATION_OIDRalph Boehme2018-03-132-4/+67
| | | | | | | | | | | | This is used to pass information about which password change operation (change or reset) the acl module validated, down to the password_hash module. It's very important that both modules treat the request identical. Bug: https://bugzilla.samba.org/show_bug.cgi?id=13272 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* CVE-2018-1057: s4:dsdb/samdb: define ↵Ralph Boehme2018-03-131-0/+9
| | | | | | | | | | | | | DSDB_CONTROL_PASSWORD_ACL_VALIDATION_OID control Will be used to pass "user password change" vs "password reset" from the ACL to the password_hash module, ensuring both modules treat the request identical. Bug: https://bugzilla.samba.org/show_bug.cgi?id=13272 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* CVE-2018-1057: s4:dsdb/acl: run password checking only onceRalph Boehme2018-03-131-0/+5
| | | | | | | | | | | This is needed, because a later commit will let the acl module add a control to the change request msg and we must ensure that this is only done once. Bug: https://bugzilla.samba.org/show_bug.cgi?id=13272 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* CVE-2018-1057: s4/dsdb: correctly detect password resetsRalph Boehme2018-03-131-1/+17
| | | | | | | | | | | | | | | | | | | | | | | This change ensures we correctly treat the following LDIF dn: cn=testuser,cn=users,... changetype: modify delete: userPassword add: userPassword userPassword: thatsAcomplPASS1 as a password reset. Because delete and add element counts are both one, the ACL module wrongly treated this as a password change request. For a password change we need at least one value to delete and one value to add. This patch ensures we correctly check attributes and their values. Bug: https://bugzilla.samba.org/show_bug.cgi?id=13272 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* CVE-2018-1057: s4:dsdb/acl: add a NULL check for talloc_new() in ↵Ralph Boehme2018-03-131-0/+4
| | | | | | | | | acl_check_password_rights() Bug: https://bugzilla.samba.org/show_bug.cgi?id=13272 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* CVE-2018-1057: s4:dsdb/acl: add check for ↵Ralph Boehme2018-03-131-0/+20
| | | | | | | | | DSDB_CONTROL_PASSWORD_HASH_VALUES_OID control Bug: https://bugzilla.samba.org/show_bug.cgi?id=13272 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* CVE-2018-1057: s4:dsdb/acl: check for internal controls before other checksRalph Boehme2018-03-131-14/+23
| | | | | | | Bug: https://bugzilla.samba.org/show_bug.cgi?id=13272 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* CVE-2018-1057: s4:dsdb/acl: remove unused else branches in ↵Ralph Boehme2018-03-131-2/+12
| | | | | | | | | acl_check_password_rights() Bug: https://bugzilla.samba.org/show_bug.cgi?id=13272 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* CVE-2018-1057: s4:dsdb/acl: only call dsdb_acl_debug() if we checked the acl ↵Ralph Boehme2018-03-131-0/+8
| | | | | | | | | in acl_check_password_rights() Bug: https://bugzilla.samba.org/show_bug.cgi?id=13272 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* CVE-2018-1057: s4:dsdb/password_hash: add a helper variable for ↵Ralph Boehme2018-03-131-6/+3
| | | | | | | | | passwordAttr->num_values Bug: https://bugzilla.samba.org/show_bug.cgi?id=13272 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* CVE-2018-1057: s4:dsdb/password_hash: add a helper variable for ↵Ralph Boehme2018-03-131-5/+9
| | | | | | | | | LDB_FLAG_MOD_TYPE Bug: https://bugzilla.samba.org/show_bug.cgi?id=13272 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* CVE-2018-1057: s4:dsdb/tests: add a test for password change with empty deleteRalph Boehme2018-03-131-0/+49
| | | | | | | | | | Note that the request using the clearTextPassword attribute for the password change is already correctly rejected by the server. Bug: https://bugzilla.samba.org/show_bug.cgi?id=13272 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* repl_md: avoid returning LDB_SUCCESS on failureDouglas Bagnall2018-02-271-1/+9
| | | | | | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=13269 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> (cherry picked from commit bc56913271e9d3a30143ef5a45d32430766d9dc3) Autobuild-User(v4-8-test): Stefan Metzmacher <metze@samba.org> Autobuild-Date(v4-8-test): Tue Feb 27 20:59:28 CET 2018 on sn-devel-144
* repl_metadata: Avoid silent skipping an object during DRS (due to RODC ↵Garming Sam2018-02-271-0/+1
| | | | | | | | | | | | | | | | | rename collisions) No error code was being set in this case, and so, we would commit the HWM and UDV without actually having all the updates. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13269 Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Garming Sam <garming@samba.org> Autobuild-Date(master): Thu Feb 15 10:18:42 CET 2018 on sn-devel-144 (cherry picked from commit 9952eda7a1923971f77f3183cfa4c505386b30ee)
* repl_metadata: Avoid silent skipping an object during DRS (due to RODC name ↵Garming Sam2018-02-271-0/+1
| | | | | | | | | | | | | collisions) No error code was being set in this case, and so, we would commit the HWM and UDV without actually having all the updates. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13269 Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> (cherry picked from commit 59fa9e7ecf84bd4c2469e9a6835855769c4f6287)
* dsdb/encrypted_secrets: remove dependency to libnettle and use our own ↵Stefan Metzmacher2018-02-275-245/+111
| | | | | | | | | | | | | | | | | | | aes_gcm_128_*() We already rely on gnutls in order to implement SSL/TLS, so using that to speed up crypto like aes gcm 128 is fine, but as we already have code for that algorithm, we should use that instead of adding a new dependency to libnettle. Some (I guess newer versions) of gnutls use nettle internally, so we may end up using that code, but we should not have a direct dependency. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13276 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> (cherry picked from commit 07844a9a13506b4ca9181cfde05d9e4170208f88)
* s4:dsdb: add dsdb_trust_domain_by_{sid,name}()Stefan Metzmacher2018-02-271-0/+222
| | | | | | | | | | | | | This gets the lsa_ForestTrustDomainInfo for the searched domain as well as the lsa_TrustDomainInfoInfoEx for the direct trust (which might be the same for external trust or the forest root domain). Bug: https://bugzilla.samba.org/show_bug.cgi?id=13286 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit e9ace1852ff88ebb7778e8db9a49bc5c61512d16)
* subnet: Avoid a segfault when renaming subnet objectsGarming Sam2018-02-202-4/+49
| | | | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=13031 Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(v4-8-test): Karolin Seeger <kseeger@samba.org> Autobuild-Date(v4-8-test): Tue Feb 20 17:54:43 CET 2018 on sn-devel-144
* repl_meta_data: fix linked attribute corruption on databases with unsorted ↵Stefan Metzmacher2018-01-251-3/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | links on expunge This is really critical bug, it removes valid linked attributes. When a DC was provisioned/joined with a Samba version older than 4.7 is upgraded to 4.7 (or later), it can happen that the garbage collection (dsdb_garbage_collect_tombstones()), triggered periodically by the 'kcc' task of 'samba' or my 'samba-tool domain tombstones expunge' corrupt the linked attributes. This is similar to Bug #13095 - Broken linked attribute handling, but it's not triggered by an originating change. The bug happens in replmd_modify_la_delete() were get_parsed_dns_trusted() generates a sorted array of struct parsed_dn based on the values in old_el->values. If the database doesn't support the sortedLinks compatibleFeatures in the @SAMBA_DSDB record, it's very likely that the array of old_dns is sorted differently than the values in old_el->values. The problem is that struct parsed_dn has just a pointer 'struct ldb_val *v' that points to the corresponding value in old_el->values. Now if vanish_links is true the damage happens here: if (vanish_links) { unsigned j = 0; for (i = 0; i < old_el->num_values; i++) { if (old_dns[i].v != NULL) { old_el->values[j] = *old_dns[i].v; j++; } } old_el->num_values = j; } old_el->values[0] = *old_dns[0].v; can change the value old_dns[1].v is pointing at! That means that some values can get lost while others are stored twice, because the LDB_FLAG_INTERNAL_DISABLE_SINGLE_VALUE_CHECK allows it to be stored. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13228 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit a25c99c9f1fd1814c56c21848c748cd0e038eed7)
* Revert "gpo: Create the gpo update service"David Mulder2018-01-132-202/+0
| | | | | | | | This reverts commit 5662e49b49f6557c80f216f510f224bbf800f40a. Signed-off-by: David Mulder <dmulder@suse.com> Reviewed-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
View Lorry Controller Status