samba.git/source3/winbindd, branch talloc-2.3.2

auth:creds: Rename CRED_USE_KERBEROS values

2020-11-03T15:25:37+00:00

Signed-off-by: Andreas Schneider 
Reviewed-by: Alexander Bokovoy

CVE-2020-14323 winbind: Fix invalid lookupsids DoS

2020-10-29T10:25:37+00:00

A lookupsids request without extra_data will lead to "state->domain==NULL",
which makes winbindd_lookupsids_recv trying to dereference it.

Reported by Bas Alberts of the GitHub Security Lab Team as GHSL-2020-134

Bug: https://bugzilla.samba.org/show_bug.cgi?id=14436
Signed-off-by: Volker Lendecke

daemons: report status to systemd even when running in foreground

2020-10-26T19:58:17+00:00

When systemd launches samba services, the configuration we have in
systemd service files expects that the main process (/usr/sbin/*)
would use sd_notify() to report back its status. However, we only use
sd_notify() when running become_daemon().

As a result, samba/smbd/winbindd/nmbd processes never report back its
status and the status updates from other childs (smbd, winbindd, etc)
are not accepted as we now have implied NotifyAccess=main since commit
d1740fb3d5a72cb49e30b330bb0b01e7ef3e09cc

This leads to a timeout and killing samba process by systemd. Situation
is reproducible in Fedora 33, for example.

Make sure that we have required status updates for all daemons in case
we aren't runnning in interactive mode.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14552

Signed-off-by: Alexander Bokovoy 
Reviewed-by: Andreas Schneider 
Reviewed-by: Jeremy Allison 

Autobuild-User(master): Jeremy Allison 
Autobuild-Date(master): Mon Oct 26 19:58:18 UTC 2020 on sn-devel-184

librpc/dcesrv_core: move two rpcint_dispatch() copies into dcesrv_call_dispatch_local()

2020-10-23T16:02:37+00:00

We only need this function once, so that we need to fix bugs only once...

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14551

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Samuel Cabrero

wb_sids2xids: defer/skip wb_lookupsids* unless we get ID_TYPE_WB_REQUIRE_TYPE

2020-10-23T04:47:26+00:00

We try to give a valid hint for predefined sids and
pass ID_TYPE_BOTH as a hint that the domain part of the sid is valid.

In most cases the idmap child/backend does not require a type_hint
as mappings already exist.

This is a speed up as we no longer need to contact a domain controller.

It's also possible to accept kerberos authentication without reaching
out to a domain controller at all (if the idmap backend doesn't need a
hint).

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14539

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Gary Lockyer 

Autobuild-User(master): Andrew Bartlett 
Autobuild-Date(master): Fri Oct 23 04:47:26 UTC 2020 on sn-devel-184

winbindd: allow idmap backends to mark entries with ID_[TYPE_WB_]REQUIRE_TYPE

2020-10-23T03:25:37+00:00

This must only be used between winbindd parent and child!
It must not leak into outside world.

Some backends require ID_TYPE_UID or ID_TYPE_GID as type_hint,
while others may only need ID_TYPE_BOTH in order to validate that
the domain exists.

This will allow us to skip the wb_lookupsids_send/recv in the winbindd parent
in future and only do that on demand.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14539

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Gary Lockyer

wb_sids2xids: build state->idmap_doms based on wb_parent_idmap_config

2020-10-23T03:25:37+00:00

In future we'll try to avoid wb_lookupsids_send() and only call
it if needed.

The domain name passed should be only relevant to find the correct
idmap backend, and these should all be available in
wb_parent_idmap_config as it was created before the idmap child was forked.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14539

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Gary Lockyer

wb_sids2xids: fill cache as soon as possible

2020-10-23T03:25:37+00:00

After adding entries to the cache we can mark them
as filled from the cache by setting its domain_index
to UINT32_MAX.

This will allow further changes to fill the results
into state->all_ids in steps.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14539

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Gary Lockyer

wb_sids2xids: directly use state->all_ids to collect results

2020-10-23T03:25:37+00:00

In order to translate the indexes from state->lookup_sids[]
for wb_lookupsids_send/recv() and state->map_ids.ids[]
for dcerpc_wbint_Sids2UnixIDs_send/recv() back to
state->all_ids.ids[] or state->sids[] we have state->tmp_idx[].

This simplifies wb_sids2xids_recv() a lot and make further
restructuring much easier.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14539

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Gary Lockyer

wb_sids2xids: change 'i' to 'li' in wb_sids2xids_lookupsids_done()

2020-10-23T03:25:37+00:00

With all the indexes we have into various array, this makes clear
'li' is the index into the state->lookup_sids array.

This makes the following changes easier to review.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14539

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Gary Lockyer