summaryrefslogtreecommitdiff
path: root/source4/ldap_server
Commit message (Collapse)AuthorAgeFilesLines
* ldap_server: Implement the rfc4532 whoami exopVolker Lendecke2023-04-261-0/+48
| | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* dsdb: modify unicodePwd requires encrypted connectionRob van der Linde2023-04-061-0/+23
| | | | | | | | | Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Thu Apr 6 01:33:05 UTC 2023 on atb-devel-224
* s4:ldap_server: let ldapsrv_call_writev_start use conn_idle_time to limit ↵Stefan Metzmacher2022-10-191-0/+5
| | | | | | | | | | | | | | | | | | | | the time If the client is not able to receive the results within connections idle time, then we should treat it as dead. It's value is 15 minutes (900 s) by default. In order to limit that further an admin can use 'socket options' and set TCP_KEEPCNT, TCP_KEEPIDLE, TCP_KEEPINTVL and/or TCP_USER_TIMEOUT to useful values. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15202 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Wed Oct 19 17:13:39 UTC 2022 on sn-devel-184
* ldap_server: Fix typosVolker Lendecke2022-04-262-2/+2
| | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* CVE-2021-3670 ldap_server: Clearly log LDAP queries and timeoutsAndrew Bartlett2021-11-251-22/+99
| | | | | | | | | | | | | | | | | | | This puts all the detail on one line so it can be searched by IP address and connecting SID. This relies on the anr handling as otherwise this log becomes the expanded query, not the original one. RN: Provide clear logs of the LDAP search and who made it, including a warning (at log level 3) for queries that are 1/4 of the hard timeout. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14694 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org> Autobuild-Date(master): Thu Nov 25 02:30:42 UTC 2021 on sn-devel-184
* CVE-2021-3670 ldap_server: Remove duplicate print of LDAP search detailsAndrew Bartlett2021-11-251-3/+0
| | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=14694 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* CVE-2021-3670 ldap_server: Ensure value of MaxQueryDuration is greater than zeroJoseph Sutton2021-11-251-1/+3
| | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=14694 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* CVE-2021-3670 ldap_server: Set timeout on requests based on MaxQueryDurationJoseph Sutton2021-11-251-1/+11
| | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=14694 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* s4:ldap_server: Use cli_credentials_init_server()Andreas Schneider2021-04-091-8/+1
| | | | Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4: rename source4/smbd/ to source4/samba/Ralph Boehme2020-11-274-7/+7
| | | | | | | | Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Ralph Böhme <slow@samba.org> Autobuild-Date(master): Fri Nov 27 10:07:18 UTC 2020 on sn-devel-184
* s4:ldap_server: Use samba_server_gensec_start() in ldapsrv_backend_Init()Stefan Metzmacher2020-09-071-26/+23
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* lib/util: remove extra safe_string.h fileMatthew DeVore2020-08-281-0/+2
| | | | | | | | | | | | | | | | | | lib/util/safe_string.h is similar to source3/include/safe_string.h, but the former has fewer checks. It is missing bcopy, strcasecmp, and strncasecmp. Add the missing elements to lib/util/safe_string.h remove the other safe_string.h which is in the source3-specific path. To accomodate existing uses of str(n?)casecmp, add #undef lines to source files where they are used. Signed-off-by: Matthew DeVore <matvore@google.com> Reviewed-by: David Mulder <dmulder@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Fri Aug 28 02:18:40 UTC 2020 on sn-devel-184
* ldap_server: Terminate LDAP connections on krb ticket expiryVolker Lendecke2020-08-213-0/+100
| | | | | | | | | | | | | | | | See RFC4511 section 4.4.1 and https://lists.samba.org/archive/cifs-protocol/2020-August/003515.html for details: Windows terminates LDAP connections when the krb5 ticket expires, Samba should do the same. This patch slightly deviates from Windows behaviour by sending a LDAP exop response with msgid 0 that is ASN1-encoded conforming to RFC4511. Bug: https://bugzilla.samba.org/show_bug.cgi?id=14465 Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* ldap_server: Add the krb5 expiry to conn->limitsVolker Lendecke2020-08-213-0/+20
| | | | | | | Bug: https://bugzilla.samba.org/show_bug.cgi?id=14465 Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* ldap_server: Fix a typoVolker Lendecke2020-08-171-1/+1
| | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* ldap_server: Do an early TALLOC_FREE()Volker Lendecke2020-08-171-0/+1
| | | | | | | | | | We don't need the asn1 struct after this point anymore Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Volker Lendecke <vl@samba.org> Autobuild-Date(master): Mon Aug 17 11:10:04 UTC 2020 on sn-devel-184
* ldap_server: Avoid talloc_memdup() for ldap_decode()Volker Lendecke2020-08-171-4/+1
| | | | | | | | | Slight optimization for the ldap server: We don't need to copy the client PDU into the ASN1 struct, the decoding process happens immediately in the same routine. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* s4 ldap_server: modernize debug callsGary Lockyer2020-05-061-16/+16
| | | | | | | Replace DEBUG(0 with DBG_ERR( Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Volker Lendecke <vl@samba.org>
* CVE-2020-10704: libcli ldap_message: Add search size limits to ldap_decodeGary Lockyer2020-05-041-2/+8
| | | | | | | | | | | | | | | | Add search request size limits to ldap_decode calls. The ldap server uses the smb.conf variable "ldap max search request size" which defaults to 250Kb. For cldap the limit is hard coded as 4096. Credit to OSS-Fuzz REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20454 BUG: https://bugzilla.samba.org/show_bug.cgi?id=14334 Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* CVE-2020-10704: S4 ldap server: Limit request sizesGary Lockyer2020-05-041-1/+95
| | | | | | | | | | | | | Check the size of authenticated and anonymous ldap requests and reject them if they exceed the limits in smb.conf Credit to OSS-Fuzz REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20454 BUG: https://bugzilla.samba.org/show_bug.cgi?id=14334 Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* CVE-2020-10704: lib util asn1: Add ASN.1 max tree depthGary Lockyer2020-05-041-1/+1
| | | | | | | | | | | | | Add maximum parse tree depth to the call to asn1_init, which will be used to limit the depth of the ASN.1 parse tree. Credit to OSS-Fuzz REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20454 BUG: https://bugzilla.samba.org/show_bug.cgi?id=14334 Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* ldap_server: Regression in 0559430ab6e5c48d6e853fda0d8b63f2e149015cGarming Sam2019-07-111-0/+1
| | | | | | | | | | | | Extended DN requests seem to have been incorrectly handled. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14029 Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> Autobuild-User(master): Gary Lockyer <gary@samba.org> Autobuild-Date(master): Thu Jul 11 05:25:26 UTC 2019 on sn-devel-184
* ldap server: generate correct referral schemesGary Lockyer2019-05-243-0/+25
| | | | | | | | | | | | | | Ensure that the referrals returned in a search request use the same scheme as the request, i.e. referrals recieved via ldap are prefixed with "ldap://" and those over ldaps are prefixed with "ldaps://" BUG: https://bugzilla.samba.org/show_bug.cgi?id=12478 Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Fri May 24 05:12:14 UTC 2019 on sn-devel-184
* ldap_server: Run ldapsrv_queue_reply() in the ldb callback, rather than ↵Andrew Bartlett2019-05-201-78/+156
| | | | | | | | | | | | waiting for the full result Based on earlier work by Garming Sam. This allows the server to stop working on a reply that will never be sent to the client as it is too large. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* ldap_server: chunk the writev() calls at 25MBAndrew Bartlett2019-05-202-1/+13
| | | | | | | | This should limit the amount we send to GENSEC at a time where it may help avoid large realloc or memcpy calls. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* ldap_server: Add explict repsonse size limit of 256MBAndrew Bartlett2019-05-202-7/+70
| | | | | | | | This allows us to replace the implicit limit via data_blob_append() removed in the previous commit. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* ldap_server: Use an array of struct iovec to avoid data_blob_append()Andrew Bartlett2019-05-202-22/+67
| | | | | | | | | | | | | | This avoids a the implicit 256MB limit on LDAP replies (allowing this to be increased in the future) and means we copy less memory around. However because we can only have 1024 entries in a struct iovec (on Linux) we will need to call tstream_writev_queue_send() multiple times. Calling it in chunks of 1024 seems a reasonable compromise, the gensec layer will chunk it out smaller if required. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* ldap_server: Run the ldap_encode() step in ldapsrv_queue_reply()Andrew Bartlett2019-05-203-24/+35
| | | | | | | | This avoids holding the memory for the response twice, by the time the result is queued it is only ASN.1 encoded. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* ldap_server: Remove success_limitAndrew Bartlett2019-05-201-9/+1
| | | | | | | | This was always set to 0 so was poinless. Any LDAP scope can return 0 entries, even a SCOPE_BASE if the filter does not match. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* ldap: Add a database open after fork to speed-up prefork bindsGarming Sam2019-05-152-1/+27
| | | | | | | | | Removing this (system) database open from the later auth stack results in a 15-30% improvement in different types of binds and on different hardware (presumably better with slower disk speeds). Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4: use ldb_msg_new(), not talloc/talloc_zeroDouglas Bagnall2019-05-101-3/+1
| | | | | | | | ldb_msg_new() is currently the same as talloc_zero(), but it might not always be. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4/ldap_bind: notice backend init failureDouglas Bagnall2019-05-101-0/+1
| | | | | | | This should silence CID 1418508 and CID 1418512 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* CVE-2018-16851 ldap_server: Check ret before manipulating blobGarming Sam2018-11-281-2/+2
| | | | | | | | | | | | | | In the case of hitting the talloc ~256MB limit, this causes a crash in the server. Note that you would actually need to load >256MB of data into the LDAP. Although there is some generated/hidden data which would help you reach that limit (descriptors and RMD blobs). BUG: https://bugzilla.samba.org/show_bug.cgi?id=13674 Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* source4 smdb: Add a post fork hook to the service APIGary Lockyer2018-11-011-11/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | Add a post fork hook to the service API this will be called: - standard process model immediately after the task_init. - single process model immediately after the task_init - prefork process model, inhibit_pre_fork = true immediately after the task_init - prefork process model, inhibit_pre_fork = false after each service worker has forked. It is not run on the service master process. The post fork hook is not called in the standard model if a new process is forked on a new connection. It is instead called immediately after the task_init. The task_init hook has been changed to return an error code. This ensures the post_fork code is only run if the task_init code completed successfully. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
* source4 smbd: Make the service_details structure constant.Gary Lockyer2018-11-011-1/+1
| | | | | | Make the service_details structure a static const. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
* ldap_server: Fix CID 1435721 Unchecked return valueVolker Lendecke2018-05-241-3/+10
| | | | | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Thu May 24 03:35:00 CEST 2018 on sn-devel-144
* ldap_server: Fix CID 1435731 Unchecked return valueVolker Lendecke2018-05-241-3/+11
| | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* samdb: Add remote address to connectGary Lockyer2018-05-101-2/+6
| | | | | Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* dsdb: pass the remote address to samdb connectGary Lockyer2018-05-101-4/+5
| | | | | Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:ldap_server: Fix size typesAndreas Schneider2018-03-201-2/+2
| | | | | | | This fixes compilation with -Wstrict-overflow=2 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* source4/smbd: Do not overstamp the process model with "single"Gary Lockyer2017-10-191-12/+6
| | | | | | | | | Instead, except in RPC which is a special SNOWFLAKE, we rely on the struct service_details in the init function. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* source4/smbd: refactor the process model for preforkGary Lockyer2017-10-191-7/+16
| | | | | | | | | | | | | | | | | | Refactor the process model code to allow the addition of a prefork process model. - Add a process context to contain process model specific state - Add a service details structure to allow service to indicate which process model options they can support. In the new code the services advertise the features they support to the process model. The process model context is plumbed through to allow the process model to keep track of the supported options, and any state the process model may require. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* ldap_server: Plumb ldb error string from a failed connect to ↵Andrew Bartlett2017-09-203-26/+42
| | | | | | | | | ldapsrv_terminate_connection() However, do not plumb it to the client-seen error string, as it could contain server paths. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* ldap: Run the LDAP server with the default (typically standard) process modelAndrew Bartlett2017-07-021-3/+6
| | | | | | | | | | | This allows one LDAP socket to proceed if another fails, and reduces the impact of a crash becoming a DoS bug, as it only impacts one socket. This may mean we have a lot of idle tasks, but this should not be a big issue Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* s4:ldap_server: implement async BindSASLStefan Metzmacher2017-06-151-8/+69
| | | | | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Thu Jun 15 13:18:47 CEST 2017 on sn-devel-144
* s4:ldap_server: set result = LDAP_SUCCESS at the end, when we're really doneStefan Metzmacher2017-06-151-3/+2
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:ldap_server: avoid using talloc_reference()Stefan Metzmacher2017-06-151-5/+9
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:ldap_server: remove useless NT_STATUS_IS_OK(status) checkStefan Metzmacher2017-06-151-1/+1
| | | | | | | | We checked a few lines above already, check with: git show -U10 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:ldap_server: remove useless indentation level arround ldapsrv_backend_Init()Stefan Metzmacher2017-06-151-15/+15
| | | | | | | Check with git show -w Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:ldap_server: remove useless indentation level arround gensec_session_info()Stefan Metzmacher2017-06-151-23/+21
| | | | | | | Check with git show -w Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
View Lorry Controller Status