summaryrefslogtreecommitdiff
path: root/source4/rpc_server
Commit message (Collapse)AuthorAgeFilesLines
* dns: merge dns_records_match and dns_record_matchDouglas Bagnall2021-06-111-66/+0
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:rpc_server: Set Kerberos to desiredAndreas Schneider2021-04-281-0/+9
| | | | | | | | | This is required for ncalrpc_as_system to work. In FIPS enabled mode, 'client use kerberos' is forced to required. We need to allow non-kerberos use for ncalrpc_as_system here. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:rpc_server: Use cli_credentials_init_server()Andreas Schneider2021-04-091-9/+3
| | | | | | This also removes dcerpc_remote:domain option for the machine account case. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* rpc/idl dnsserver s/DNS_RPC_DATA/DNS_RPC_RECORD_DATA/Douglas Bagnall2021-03-301-1/+1
| | | | | | | | | | Following MS-DNSP. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Tue Mar 30 00:20:53 UTC 2021 on sn-devel-184
* librpc/idl: dnsp tombstone timestamp name matches MS-DNSPDouglas Bagnall2021-03-291-2/+2
| | | | | | | | | | MS-DNSP uses the term "EntombedTime" in e.g. "2.2.2.2.4.23 DNS_RPC_RECORD_TS" which is more descriptive than the generic "timestamp", and less likely to be confused with dwTimestamp, which has been our curse. Let's make it grep-able, google-able, and evocative. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jeremy Allison <jra@samba.org>
* smb.conf: Remove "share backend" optionAndrew Bartlett2021-03-262-9/+9
| | | | | | | | This is a confusing hold-over from the NTVFS fileserver that never became part of the merged architecture. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* rpc_server4: Make "srv_callbacks" staticVolker Lendecke2021-03-161-1/+1
| | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* librpc: Add "private_data" to struct dcesrv_context_callbacksVolker Lendecke2021-03-161-5/+11
| | | | | | | | | Not used right now, but we should never have callbacks without a "private_data" pointer. Some of the callbacks could even today benefit from this. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* s4:rpc_server: Add missing break in switch statementAndreas Schneider2021-02-011-0/+1
| | | | | | | error: unannotated fall-through between switch labels [-Werror,-Wimplicit-fallthrough] Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* epmapper: Simplify _epm_Map()Volker Lendecke2021-01-281-2/+1
| | | | | | | We have a routine to compare ndr_syntax_id, don't do it manually. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Samuel Cabrero <scabrero@samba.org>
* rpc_server: Fix a "bool==true" conditionVolker Lendecke2021-01-221-1/+1
| | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* rpc_server: Fix a typoVolker Lendecke2021-01-221-1/+1
| | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* s4: rename source4/smbd/ to source4/samba/Ralph Boehme2020-11-272-3/+3
| | | | | | | | Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Ralph Böhme <slow@samba.org> Autobuild-Date(master): Fri Nov 27 10:07:18 UTC 2020 on sn-devel-184
* s4:rpc_server: Allow to use RC4 for creating trustsAndreas Schneider2020-11-091-0/+18
| | | | | | Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* s4:rpc_server: Use gnutls_cipher_decrypt() in get_trustdom_auth_blob()Andreas Schneider2020-11-091-1/+1
| | | | | | It doesn't matter for RC4, but just to be correct. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org>
* s4:rpc_server: Allow to use RC4 for setting passwordsAndreas Schneider2020-10-292-1/+31
| | | | Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org>
* CVE-2020-1472(ZeroLogon): rpc_server/netlogon: Fix confounder checkGary Lockyer2020-10-161-1/+1
| | | | | | | | | Add check for zero length confounder, to allow setting of passwords 512 bytes long. This does not need to be backported, as it is extremely unlikely that anyone is using 512 byte passwords. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* Fix build after removal of an extra safe_string.hAlexander Bokovoy2020-10-011-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | Move of strcasecmp redefine to lib/util/safe_string.h in https://gitlab.com/samba-team/samba/-/merge_requests/1507 broke build on Fedora 33 with GCC 10.2.1 for those compilation units that use ldb_att_cmp(). The reason for that is that ldb_attr_cmp() defined as #define ldb_attr_cmp(a, b) strcasecmp(a, b) because attribute names restricted to be ASCII by RFC2251 (LDAPv3 spec). A solution is to add #undef strcasecmp to all source code files which use ldb_attr_cmp(). Signed-off-by: Alexander Bokovoy <ab@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Thu Oct 1 22:45:29 UTC 2020 on sn-devel-184
* CVE-2020-1472(ZeroLogon): s4:rpc_server/netlogon: log warnings about ↵Stefan Metzmacher2020-09-181-3/+63
| | | | | | | | | | | | | | unsecure configurations This should give admins wawrnings until they have a secure configuration. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14497 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> Reviewed-by: Günther Deschner <gd@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* CVE-2020-1472(ZeroLogon): s4:rpc_server/netlogon: support "server require ↵Stefan Metzmacher2020-09-181-1/+8
| | | | | | | | | | | | schannel:WORKSTATION$ = no" This allows to add expections for individual workstations, when using "server schannel = yes". "server schannel = auto" is very insecure and will be removed soon. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14497 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* CVE-2020-1472(ZeroLogon): s4:rpc_server/netlogon: refactor ↵Stefan Metzmacher2020-09-181-12/+33
| | | | | | | | | | | dcesrv_netr_creds_server_step_check() We should debug more details about the failing request. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14497 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* CVE-2020-1472(ZeroLogon): s4:rpc_server/netlogon: protect ↵Stefan Metzmacher2020-09-181-1/+59
| | | | | | | | | netr_ServerPasswordSet2 against unencrypted passwords BUG: https://bugzilla.samba.org/show_bug.cgi?id=14497 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* CVE-2020-1472(ZeroLogon): s4:rpc_server:netlogon: make use of ↵Stefan Metzmacher2020-09-181-2/+1
| | | | | | | | | | | netlogon_creds_random_challenge() This is not strictly needed, but makes things more clear. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14497 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* s4:rpc_server: Use cli_credentials_init_server()Andreas Schneider2020-09-071-14/+3
| | | | Signed-off-by: Andreas Schneider <asn@samba.org>
* lib/util: remove extra safe_string.h fileMatthew DeVore2020-08-2811-0/+22
| | | | | | | | | | | | | | | | | | lib/util/safe_string.h is similar to source3/include/safe_string.h, but the former has fewer checks. It is missing bcopy, strcasecmp, and strncasecmp. Add the missing elements to lib/util/safe_string.h remove the other safe_string.h which is in the source3-specific path. To accomodate existing uses of str(n?)casecmp, add #undef lines to source files where they are used. Signed-off-by: Matthew DeVore <matvore@google.com> Reviewed-by: David Mulder <dmulder@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Fri Aug 28 02:18:40 UTC 2020 on sn-devel-184
* s4/dns: do not crash when additional data not foundDouglas Bagnall2020-08-241-3/+4
| | | | | | | | | | | | Found by Francis Brosnan Blázquez <francis@aspl.es>. BUG: https://bugzilla.samba.org/show_bug.cgi?id=12795 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org> Autobuild-Date(master): Mon Aug 24 00:21:41 UTC 2020 on sn-devel-184
* s4: dns: Ensure variable initialization with NULL.Douglas Bagnall2020-08-231-11/+13
| | | | | | | | | | | | Ensure no use after free. Based on patches from Francis Brosnan Blázquez <francis@aspl.es> and Jeremy Allison <jra@samba.org> BUG: https://bugzilla.samba.org/show_bug.cgi?id=12795 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jeremy Allison <jra@samba.org>
* lib: relicense smb_strtoul(l) under LGPLv3Ralph Boehme2020-08-031-0/+1
| | | | | | | | | Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Swen Schillig <swen@linux.ibm.com> Reviewed-by: Volker Lendecke <vl@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Mon Aug 3 22:21:04 UTC 2020 on sn-devel-184
* s4:rpc_server: Implement epmapper LookupHandleFreeSamuel Cabrero2020-07-071-1/+10
| | | | | | | | | Signed-off-by: Samuel Cabrero <scabrero@samba.org> Reviewed-by: David Mulder <dmulder@suse.com> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Samuel Cabrero <scabrero@samba.org> Autobuild-Date(master): Tue Jul 7 13:43:14 UTC 2020 on sn-devel-184
* librpc: core: Move the s4 handles implementation to the RPC server coreSamuel Cabrero2020-05-242-364/+1
| | | | | Signed-off-by: Samuel Cabrero <scabrero@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4/rpc_server/dnsserver: Allow parsing of dnsProperty to fail gracefullyAndrew Bartlett2020-05-151-7/+65
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | On (eg) the DC=_msdcs.X.Y,CN=MicrosoftDNS,DC=ForestDnsZones,DC=X,DC=Y record, in domains that have had a Microsoft Windows DC an attribute: dNSProperty:: AAAAAAAAAAAAAAAAAQAAAJIAAAAAAAAA 000000 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 >................< 000010 92 00 00 00 00 00 00 00 >........< 000018 We, until samba 4.12, would parse this as: pull returned Success dnsp_DnsProperty: struct dnsp_DnsProperty wDataLength : 0x00000000 (0) namelength : 0x00000000 (0) flag : 0x00000000 (0) version : 0x00000001 (1) id : DSPROPERTY_ZONE_NS_SERVERS_DA (146) data : union dnsPropertyData(case 0) name : 0x00000000 (0) dump OK However, the wDataLength is 0. There is not anything in [MS-DNSP] 2.3.2.1 dnsProperty to describe any special behaviour for when the id suggests that there is a value, but wDataLength is 0. https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-dnsp/445c7843-e4a1-4222-8c0f-630c230a4c80 We now fail to parse it, because we expect an entry with id DSPROPERTY_ZONE_NS_SERVERS_DA to therefore have a valid DNS_ADDR_ARRAY (section 2.2.3.2.3). As context we changed it in our commit fee5c6a4247aeac71318186bbff7708d25de5912 because of bug https://bugzilla.samba.org/show_bug.cgi?id=14206 which was due to the artificial environment of the fuzzer. Microsoft advises that Windows also fails to parse this, but instead of failing the operation, the value is ignored. Reported by Alex MacCuish. Many thanks for your assistance in tracking down the issue. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14310 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Fri May 15 07:29:17 UTC 2020 on sn-devel-184
* s4:rpc_server/lsa: remove some useless talloc_reference() callsStefan Metzmacher2020-02-051-10/+10
| | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* pidl:NDR/Server: Allow to define endpoint server shutdown functionsSamuel Cabrero2019-12-121-0/+7
| | | | | | | | | | | | | | The next commits will register legacy api_struct when the endpoint server is initialized. This commit adds a shutdown function which will be used to unregister the legacy api_struct. The shutdown function will be also used to replace the rpc_srv_callbacks struct shutdown member used, for example, by the spoolss service to cleanup before exiting. Signed-off-by: Samuel Cabrero <scabrero@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* librpc:core: Add public functions to initialize endpoint serversSamuel Cabrero2019-12-121-0/+2
| | | | | | | | | | | | | | | The dcesrv_init_registered_ep_servers() will be used by the S3 server to initialize all registered endpoint servers (for embedded services), and the dcesrv_init_ep_server() function will be used by the external daemons to initialize the required ones. As serveral S3 services may require to initialize another one before itself (svcctl and eventlog for example require winreg) a boolean flag is added to track the initialization status. Signed-off-by: Samuel Cabrero <scabrero@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* librpc:core: Split dcesrv context init and endpoint servers initSamuel Cabrero2019-12-121-1/+7
| | | | | | | | | | The S4 server will initialize the endpoint servers specified in smb.conf, but the S3 server need to initialize all registered endpoint servers (the embedded ones). Signed-off-by: Samuel Cabrero <scabrero@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* CVE-2019-14861: s4-rpc/dnsserver: Avoid crash in ldb_qsort() via ↵Andrew Bartlett2019-12-103-27/+17
| | | | | | | | | | | | | | | | | dcesrv_DnssrvEnumRecords) dns_name_compare() had logic to put @ and the top record in the tree being enumerated first, but if a domain had both then this would break the older qsort() implementation in ldb_qsort() and cause a read of memory before the base pointer. By removing this special case (not required as the base pointer is already seperatly located, no matter were it is in the returned records) the crash is avoided. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14138 Signed-off-by: Andrew Bartlett <abartlet@samba.org>
* CVE-2019-14861: s4-rpc_server: Remove special case for @ in dns_build_tree()Andrew Bartlett2019-12-101-4/+5
| | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=14138 Signed-off-by: Andrew Bartlett <abartlet@samba.org>
* session: convert sess_crypt_blob to use gnutlsIsaac Boukris2019-12-101-2/+11
| | | | | Signed-off-by: Isaac Boukris <iboukris@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* smbdes: convert des_crypt112_16 to use gnutlsIsaac Boukris2019-12-101-3/+10
| | | | | Signed-off-by: Isaac Boukris <iboukris@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* smbdes: convert E_old_pw_hash to use gnutlsIsaac Boukris2019-12-101-2/+14
| | | | | Signed-off-by: Isaac Boukris <iboukris@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* smbdotconf: mark "server string" with substitution="1"Ralph Boehme2019-11-271-2/+4
| | | | | Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* build: Do not build selftest binaries for builds without --enable-selftestAndrew Bartlett2019-11-221-9/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add new for_selftest option to SAMBA_BINARY() and SAMBA3_BINARY() This allows us to be much more consistent (at least in the core Samba) and documents clearly why the binary should not be installed. Not modified are - test_lp_load - notifyd-tests - gendrandperf - test* from examples/libsmbclient - dbwrap_torture - split_tokens - locktest2 - msgtest - msg_sink - msg_source - versiontest - rpc_open_tcp - test_headers As these are not tested in selftest so any change would also be untested. Of course they probably should be added in a different MR. Also not modified (because they are not tests, nor part of the build system) are: - smb2mount - notifydd - log2pacp - debug2html - smbfilter - destroy_netlogon_creds_cli - spotlight2* - tevent_glib_tracker These do however appear to be untested. For now, the source4 forked client tools are left unchanged: - smbclient4 - nmblookup4 Finally, the heimdal binaries are left as install=False as they are either part of the build system or end-user tools that we just don't want to install. These are however tested. The motivation is commit like c34ec003b7d45aa4196ff93a0ac29694b25e5309 and da87fa998ab71328f30bcdf5b41aee8675aee48a, which are both totally correct but are not needed if the selftest is not run on MacOS. There are likely other platforms or build environments where building our test binaries is more pain than valuable, see for example also https://lists.samba.org/archive/samba/2019-November/227137.html Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Isaac Boukris <iboukris@samba.org> Autobuild-User(master): Isaac Boukris <iboukris@samba.org> Autobuild-Date(master): Fri Nov 22 11:48:59 UTC 2019 on sn-devel-184
* s4:rpc_server: Return the status code from dcesrv_transport_session_key()Andreas Schneider2019-11-201-4/+3
| | | | | | | | | | | | | | Normally this returns the right status code, which normally is: NT_STATUS_NO_USER_SESSION_KEY This is consitent with the source3 samr server implmentation. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Isaac Boukris <iboukris@samba.org> Autobuild-User(master): Isaac Boukris <iboukris@samba.org> Autobuild-Date(master): Wed Nov 20 22:29:35 UTC 2019 on sn-devel-184
* librpc: Unify packet dumping on ndr_pull() failureAndrew Bartlett2019-11-201-3/+0
| | | | | | | | | | | | | | | | There were two duplicate implementations of packet dumping just for the s4 RPC server! This unifies them and makes them easier to find because they are not triggered from the generated server stub any more. The behaviour have unified on setting "dcesrv:stubs directory" and being compiled with --enable-developer. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Samuel Cabrero <scabrero@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Wed Nov 20 02:14:56 UTC 2019 on sn-devel-184
* s4:rpc_server: Remove gnutls_global_(de)init()Andreas Schneider2019-11-141-3/+0
| | | | | | | This is done by the gnutls library constructor/destructor. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* source4/rpc_server/lsa/lsa_lookup.c: typo fixesBjörn Jacke2019-10-311-4/+4
| | | | | Signed-off-by: Bjoern Jacke <bjacke@samba.org> Reviewed-by: Martin Schwenke <martin@meltin.net>
* librpc:core: Allocate struct dcesrv_interface with tallocSamuel Cabrero2019-10-182-6/+7
| | | | | | | | | The S3 implementation needs to reinit the dcesrv_context and free the endpoints list with their registered interfaces. Signed-off-by: Samuel Cabrero <scabrero@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* s4:rpc_server: Move core functions to core librarySamuel Cabrero2019-10-185-3829/+2
| | | | | | Signed-off-by: Samuel Cabrero <scabrero@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* s4:rpc_server: Move core structures and prototypes to core librarySamuel Cabrero2019-10-181-577/+1
| | | | | | Signed-off-by: Samuel Cabrero <scabrero@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* librpc: Add new dcerpc server core librarySamuel Cabrero2019-10-181-1/+1
| | | | | | | | Next commits will move the core of s4 rpc server to this library. Signed-off-by: Samuel Cabrero <scabrero@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
View Lorry Controller Status