samba.git/source3/lib/tldap.c, branch talloc-2.3.4

lib: Align integer types

2020-12-04T21:08:38+00:00

Signed-off-by: Volker Lendecke 
Reviewed-by: Jeremy Allison

tldap: Receiving "msgid == 0" means the connection is dead

2020-08-21T20:37:24+00:00

We never use msgid=0, see tldap_next_msgid(). RFC4511 section 4.4.1
says that the unsolicited disconnect response uses msgid 0. We don't
parse this message, which supposedly is an extended response: Windows
up to 2019 sends an extended response in an ASN.1 encoding that does
not match RFC4511.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=14465

Signed-off-by: Volker Lendecke 
Reviewed-by: Stefan Metzmacher 

Autobuild-User(master): Volker Lendecke 
Autobuild-Date(master): Fri Aug 21 20:37:25 UTC 2020 on sn-devel-184

tldap: Add PRINTF_ATTRIBUTE declaration to tldap_debug()

2020-08-21T19:14:33+00:00

Bug: https://bugzilla.samba.org/show_bug.cgi?id=14465

Signed-off-by: Volker Lendecke 
Reviewed-by: Stefan Metzmacher

tldap: Make sure all requests are cancelled on rundown

2020-08-21T19:14:33+00:00

Put messages into the ld->pending array before sending them out, not
after they have been sent.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=14465

Signed-off-by: Volker Lendecke 
Reviewed-by: Stefan Metzmacher

tldap: Centralize connection rundown on error

2020-08-21T19:14:33+00:00

Whenever send or recv return -1, we have to cancel all pending
requests and our transport stream is no longer usable: Discard it upon
such an error.

To avoid duplicate state, tldap_connection_ok() now looks at whether
we have a tstream_context around.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=14465

Signed-off-by: Volker Lendecke 
Reviewed-by: Stefan Metzmacher

tldap: Maintain the ldap read request in tldap_context

2020-08-21T19:14:33+00:00

Required for proper connection rundown, we need to TALLOC_FREE() the
read request before shutting down the tstream

Bug: https://bugzilla.samba.org/show_bug.cgi?id=14465

Signed-off-by: Volker Lendecke 
Reviewed-by: Stefan Metzmacher

tldap: Always remove ourselves from ld->pending at cleanup time

2020-08-21T19:14:33+00:00

Bug: https://bugzilla.samba.org/show_bug.cgi?id=14465

Signed-off-by: Volker Lendecke 
Reviewed-by: Stefan Metzmacher

tldap: Fix tldap_msg_received()

2020-08-21T19:14:33+00:00

The callback of "req" might have destroyed "ld", we can't reference
this anymore after calling tevent_req_done(req). Defer calling the
callbacks, which also means that the callbacks can't have added
anything to ld->pending.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=14465

Signed-off-by: Volker Lendecke 
Reviewed-by: Stefan Metzmacher

tldap: Only free() ld->pending if "req" is part of it

2020-08-21T19:14:32+00:00

Best reviewed with "git show -U10". We need to check that "req" is
actually the last request that is being freed before freeing the whole
array.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=14465

Signed-off-by: Volker Lendecke 
Reviewed-by: Stefan Metzmacher

CVE-2020-10704: lib util asn1: Add ASN.1 max tree depth

2020-05-04T02:59:31+00:00

Add maximum parse tree depth to the call to asn1_init, which will be
used to limit the depth of the ASN.1 parse tree.

Credit to OSS-Fuzz

REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20454
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14334

Signed-off-by: Gary Lockyer 
Reviewed-by: Andrew Bartlett