samba.git/source3/winbindd/winbindd_pam_auth_crap.c, branch talloc-2.4.4

CVE-2022-2127: winbindd: Fix WINBINDD_PAM_AUTH_CRAP length checks

2023-07-21T12:05:35+00:00

With WBFLAG_BIG_NTLMV2_BLOB being set plus lm_resp_len too large you
can crash winbind. We don't independently check lm_resp_len
sufficiently.

Discovered via Coverity ID 1504444 Out-of-bounds access

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15072

Signed-off-by: Volker Lendecke

s3:winbind: Convert PAM_AUTH_CRAP from struct based to NDR based

2022-04-30T00:10:34+00:00

Signed-off-by: Samuel Cabrero 
Reviewed-by: Jeremy Allison

s3:winbind: Refactor winbindd_pam_auth_crap_{send,recv}

2022-04-30T00:10:34+00:00

The winbindd_dual_pam_auth_crap() will be converted to a local RPC call
handler and the winbindd_response won't be filled by the child process
but in the parent's winbindd_pam_auth_crap_recv() function.

Move all code filling the winbindd_response struct to a common place,
winbindd_pam_auth_crap_recv().

Signed-off-by: Samuel Cabrero 
Reviewed-by: Jeremy Allison

s3:winbind: Refactor winbindd_pam_auth_crap_{send,recv}

2022-04-30T00:10:34+00:00

Move the code filling the winbindd_response to a common place,
winbindd_pam_auth_crap_recv().

Signed-off-by: Samuel Cabrero 
Reviewed-by: Jeremy Allison

s3:winbind: Use temp memory context in winbindd_pam_auth_pac_verify()

2022-04-30T00:10:34+00:00

Signed-off-by: Samuel Cabrero 
Reviewed-by: Jeremy Allison

s3:winbind: Move big NTLMv2 blob checks to parent process

2022-04-30T00:10:34+00:00

The winbindd_dual_pam_auth_crap() function will be converted to a local
RPC call handler and it won't receive a winbindd_cli_state struct. Move
the checks accessing this struct to the parent.

Signed-off-by: Samuel Cabrero 
Reviewed-by: Jeremy Allison

s3:winbind: Use uint8_t for authoritative flag

2022-04-30T00:10:34+00:00

It is the type used in the winbindd_response struct.

Signed-off-by: Samuel Cabrero 
Reviewed-by: Jeremy Allison

CVE-2020-25717: s3:winbindd: make sure we default to r->out.authoritative = true

2021-11-09T19:45:32+00:00

We need to make sure that temporary failures don't trigger a fallback
to the local SAM that silently ignores the domain name part for users.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14556

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett

lib: give global_contexts.c its own header file

2021-01-08T20:31:33+00:00

It's a bit shocking how many references we have to global
contexts. Make this a bit more obvious.

Signed-off-by: Volker Lendecke 
Reviewed-by: Ralph Boehme 
Reviewed-by: Jeremy Allison

s3: safe_string: do not include string_wrappers.h

2020-08-28T00:56:34+00:00

Rather than have safe_string.h #include string_wrappers.h, make users of
string_wrappers.h include it explicitly.

includes.h now no longer includes string_wrappers.h transitively. Still
allow includes.h to #include safe_string.h for now so that as many
modules as possible get the safety checks in it.

Signed-off-by: Matthew DeVore 
Reviewed-by: David Mulder 
Reviewed-by: Jeremy Allison