summaryrefslogtreecommitdiff
path: root/source4
Commit message (Collapse)AuthorAgeFilesLines
* dsdb: Add tests for large LDAP responsesAndrew Bartlett2019-05-172-0/+272
| | | | | | | | | | | This behaviour is Samba-specific, we have not traditionally cut of responses at 1000 or so as Windows does, and we need to change that behaviour carefully. This triggers this bug in TDB: BUG: https://bugzilla.samba.org/show_bug.cgi?id=13952 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* s4: squash 'cast between incompatible function types' warningNoel Power2019-05-168-39/+125
| | | | | | | | | | | | | | To avoid warning above produced by using -Wcast-function-type we; + ensure PyCFunctions of type METH_NOARGS defined dummy arg + ensure PyCFunctions of type METH_KEYWORDS use PY_DISCARD_FUNC_SIG macro + ensure PyCFunctions of type METH_KEYWORDS really actually use the problematic kargs param, if not remove it Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Andreas Schneider <asn@samba.org>
* s4/librpc: squash 'cast between incompatible function types' warningNoel Power2019-05-163-7/+18
| | | | | | | | | | Where possible make PyCFunction definition signature match. Sometimes this is not possible (e.g. when the c-function is associated with a python method definition with 'METH_VARARGS|METH_KEYWORDS' in this case we use the PY_DISCARD_FUNC_SIG macro. Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Andreas Schneider <asn@samba.org>
* s3/ntvfs: squash 'cast between incompatible function types' warningNoel Power2019-05-163-3/+6
| | | | | | | | | Fix various PyCFunction definitions to avoid 'cast between incompatible function types' warnings when compiled with -Wcast-function-type Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Andreas Schneider <asn@samba.org>
* s4 dsdb/repl_meta_data: fix use after free in dsdb_audit_add_ldb_valueGary Lockyer2019-05-151-0/+36
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix use after free detected by AddressSanitizer AddressSanitizer: heap-use-after-free on address 0x61400026a4a0 at pc 0x7fd555c52f12 bp 0x7ffed7231180 sp 0x7ffed7231170 READ of size 1 at 0x61400026a4a0 thread T0 #0 0x7fd555c52f11 in ldb_should_b64_encode ../../lib/ldb/common/ldb_ldif.c:197 #1 0x7fd539dc9417 in dsdb_audit_add_ldb_value ../../source4/dsdb/samdb/ldb_modules/audit_util.c:491 #2 0x7fd539dc9417 in dsdb_audit_attributes_json ../../source4/dsdb/samdb/ldb_modules/audit_util.c:651 #3 0x7fd539dc6a7e in operation_json ../../source4/dsdb/samdb/ldb_modules/audit_log.c:305 The problem is that at the successful end of these functions el->values is overwritten with new_values. However get_parsed_dns() points p->v at the supplied el and it effectively gets used as a working area by replmd_build_la_val(). So we must duplicate it because our caller only called ldb_msg_copy_shallow(). The reason this matters is that the audit_log module is above repl_meta_data in the stack, and tries to log the ldb_message it saw after the reply (to include the error code). If that ldb_message is changed it is not only misleading, it can point to memory that has since gone away. In this case the memory for the full extended DN in the member attribute ended up on 'ac', a context lost by the time repl_meta_data has finished processing. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13941 Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Wed May 15 05:35:47 UTC 2019 on sn-devel-184
* s4 dsdb/repl_meta_data: allocate new extended DNs during ADD on a better contextAndrew Bartlett2019-05-151-1/+1
| | | | | | | | | | | | Lower down in this function new_values is assigned over el->values and is filled in with the values of all the parsed DNs. Therefore it is the natural talloc parent. This will allow el->values to be allocated on tmp_ctx in the next commit for a working area during the function call. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* ldap: Add a database open after fork to speed-up prefork bindsGarming Sam2019-05-152-1/+27
| | | | | | | | | Removing this (system) database open from the later auth stack results in a 15-30% improvement in different types of binds and on different hardware (presumably better with slower disk speeds). Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* ldb: remove unpack only attr list functionalityAaron Haslett2019-05-151-11/+4
| | | | | | | | | | | | | | | | | Unpack functions currently take an attribute list to restrict the set of attributes to be returned in the constructed message. This functionality is never used and complicates implementation of forthcoming new pack format. This patch removes that functionality. Using the unpack function then filtering the result turns out not to be any slower. NOTE: Configure with --abi-check-disable to build this commit. This patch is part of a set of LDB ABI changes, and the version update is done on the last commit. Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* ldb: move ldb_kv's filter into pack codeAndrew Bartlett2019-05-151-12/+19
| | | | | | | | | | | | | | | | This patch moves ldb_kv's filter code into the pack code to replace 'only attr list' functionality which will be removed in forthcoming commit. Unpacking data then filtering the result is not any slower than the removed 'only attr list' approach. 'only attr list' test repurposed to test unpack -> filter flow. NOTE: Configure with --abi-check-disable to build this commit. This patch is part of a set of LDB ABI changes, and the version update is done on the last commit. Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* ldb: perf test for pack formatAaron Haslett2019-05-151-0/+79
| | | | | | | | | | | | | Performance test for pack function and unpack function run with flag LDB_UNPACK_DATA_FLAG_NO_DATA_ALLOC. Run this test before and after forthcoming pack format changes to test throughput improvement. On my machine, the unpack improvement is around 50%. The test doesn't really belong in LDB torture but it's the only place where all the required functions are available. Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* ldb: removing alloc from unpack_dataAaron Haslett2019-05-151-18/+0
| | | | | | | | | | | | Making unpack flag LDB_UNPACK_DATA_FLAG_NO_DATA_ALLOC required behaviour, since allocating data during unpack is slow and unnecessary in all current usages. In any future unpack usage, if editing of returned memory is required, some function that duplicates the message should be used, such as one of the filter_attrs functions, or msg_copy. Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* CVE-2018-16860 Heimdal KDC: Reject PA-S4U2Self with unkeyed checksumIsaac Boukris2019-05-141-0/+7
| | | | | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=13685 Signed-off-by: Isaac Boukris <iboukris@gmail.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Signed-off-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Karolin Seeger <kseeger@samba.org> Autobuild-Date(master): Tue May 14 11:45:13 UTC 2019 on sn-devel-184
* CVE-2018-16860 selftest: Add test for S4U2Self with unkeyed checksumIsaac Boukris2019-05-141-4/+101
| | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=13685 Signed-off-by: Isaac Boukris <iboukris@gmail.com> Signed-off-by: Andrew Bartlett <abartlet@samba.org>
* s4 dsdb: fix use after free in samldb_rename_search_base_callbackGary Lockyer2019-05-141-1/+0
| | | | | | | | | | | | | | | | | | | Fix use after free detected by AddressSanitizer AddressSanitizer: heap-use-after-free on address 0x60f0002b2738 at pc 0x7f89b1a213b5 bp 0x7ffce9528810 sp 0x7ffce9528800 READ of size 8 at 0x60f0002b2738 thread T0 #0 0x7f89b1a213b4 in samldb_rename_search_base_callback ../../source4/dsdb/samdb/ldb_modules/samldb.c:4203 #1 0x7f89d3a0db4a in ldb_module_send_entry ../../lib/ldb/common/ldb_modules.c:793 #2 0x7f89b6f27356 in es_callback ../../source4/dsdb/samdb/ldb_modules/encrypted_secrets.c:1418 Bug: https://bugzilla.samba.org/show_bug.cgi?id=13942 Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4 librpc rpc pyrpc: Ensure tevent_context deleted lastGary Lockyer2019-05-103-28/+39
| | | | | | | | | | | | | | Ensure that the tevent_context is deleted after the connection, to prevent a use after free. Note: Py_DECREF calls dcerpc_interface_dealloc so the TALLOC_FREE(ret->mem_ctx) calls in the error paths of py_dcerpc_interface_init_helper needed removal. Bug: https://bugzilla.samba.org/show_bug.cgi?id=13932 Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* samba_dnsupdate: flush dns update cache file after writeJoe Guo2019-05-101-0/+1
| | | | | | | | | | While running samba python tests with `coverage.py`, `make test` failed to start ad_dc env since dns_update_cache stays empty. Flush the file after write fix the issue. Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* s4/lib/policy/gp_ldap: use ldb API to find messagesDouglas Bagnall2019-05-101-12/+12
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* dsdb mod/linked_attributes: fix_link_slow(): clarify a comment.Douglas Bagnall2019-05-101-1/+2
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* dsdb/mod/extended_dn_out: use faster removal filtersDouglas Bagnall2019-05-101-20/+16
| | | | | | | | | When filtering out multiple elements, we end up memmove()ing the same elements many times over. It is simpler to not do that by keeping track of how many elements we are keeping. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* dsdb/replmd: use ldb_msg_remove_element()Douglas Bagnall2019-05-101-2/+1
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* dsdb mods/extended_dn_out: remove element using ldb_msg apiDouglas Bagnall2019-05-101-4/+1
| | | | | | | The bare memmove is not strictly safe at the end of the list. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* dsdb/mod/extended_dn_out: zero whole fake_msg structDouglas Bagnall2019-05-101-8/+6
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4: use ldb_msg_new(), not talloc/talloc_zeroDouglas Bagnall2019-05-103-6/+4
| | | | | | | | ldb_msg_new() is currently the same as talloc_zero(), but it might not always be. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* dsdb/util: spell "equivalence"!Douglas Bagnall2019-05-101-1/+1
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4/policy/gp_filesys: avoid SIZE_MAX smbcli write (CID 1034779)Douglas Bagnall2019-05-101-0/+6
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4/messaging: do not deref NULL state (CID 1437973)Douglas Bagnall2019-05-101-4/+4
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4/ldap_bind: notice backend init failureDouglas Bagnall2019-05-101-0/+1
| | | | | | | This should silence CID 1418508 and CID 1418512 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* dsdb/mod/count_attrs: set ldb var before using it (CID 1444979)Douglas Bagnall2019-05-091-1/+3
| | | | | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org> Autobuild-Date(master): Thu May 9 23:54:35 UTC 2019 on sn-devel-184
* s4/dsdb/util_samr: check some return codes (CID 1444977)Douglas Bagnall2019-05-091-5/+19
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* s4/dnsserver: delay return when trying to log (CID 1444976)Douglas Bagnall2019-05-091-2/+1
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* s4/dnsserver: handle broken zone values in sort (CID 1414763, 1414769)Douglas Bagnall2019-05-091-1/+9
| | | | | | | | We sort NULL values to the end of the list. What happens to the after that is another question. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* pyrpc: remove crutch for python <= 2.5Douglas Bagnall2019-05-091-4/+0
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* pyrpc: ndr PY_CHECK_TYPE checks for NULL as well as typeDouglas Bagnall2019-05-091-4/+13
| | | | | | | Addresses CID 1361477 and others. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* dsdb/modules/linked_attrs: remove pointless check (CID 240768)Douglas Bagnall2019-05-091-1/+1
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* dsdb/modules/dirsync: ensure attrs exist (CID 1107212)Douglas Bagnall2019-05-091-0/+4
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* dsdb/modules/dirsync: remove useless function callDouglas Bagnall2019-05-091-1/+0
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* dsdb/modules/dirsync: avoid possible NULL dereference (CID 1034800)Douglas Bagnall2019-05-091-0/+3
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* dsdb/modules/acl: avoid deref of missing data (CID 1107200)Douglas Bagnall2019-05-091-2/+4
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* s4/auth/sam: silence CID 1435849Douglas Bagnall2019-05-091-2/+4
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* s4/rpc/dcerpc_roh_channel_out: check ndr_init (CID 1273062)Douglas Bagnall2019-05-091-0/+3
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* s4/rpc/dcerpc_roh_channel_out: check ndr_init (CID 1273065)Douglas Bagnall2019-05-091-0/+3
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* s4/rpc/drsuapi/writespn: check the actual error code (CID 1034691)Douglas Bagnall2019-05-091-2/+2
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* s4/rpc/dns: check for IP address errors at startupDouglas Bagnall2019-05-091-4/+10
| | | | | | | | | The silent failure might leave an indeterminate or zero address. CID: 1272838 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* rpc/dns: reduce the CID count on temporary variablesDouglas Bagnall2019-05-091-0/+2
| | | | | | | CID 1363189 and others. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* rpc/dns: leak less on memory failure (CID 1363191)Douglas Bagnall2019-05-091-0/+1
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* rpc/dnsdata: avoid crash on missing attr (CID: 1414757)Douglas Bagnall2019-05-091-0/+6
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* rpc/dnsdata: do not crash if message attr missing (CID: 1414773)Douglas Bagnall2019-05-091-0/+5
| | | | | | | This should be hard to trigger, but goto fail is always nicer than sig 11. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* s4 lib socket: Ensure address string owned by parent structGary Lockyer2019-05-081-1/+1
| | | | | | | | | | | | | | The local address string was not owned by it's parent structure, which caused a use after free error in continue_ip_open_socket source4/librpc/rpc/dcerpc_sock.c:267 BUG: https://bugzilla.samba.org/show_bug.cgi?id=13929 Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Wed May 8 20:03:42 UTC 2019 on sn-devel-184
* s4:torture: Do not free full_name before we printed itAndreas Schneider2019-05-081-1/+1
| | | | | | | Found by GCC 9. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* s4:torture: Do not print NULL strings we just checked beforeAndreas Schneider2019-05-081-4/+4
| | | | | | | Found by GCC 9. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
View Lorry Controller Status