samba.git/source4/ldap_server, branch talloc-2.3.2

s4:ldap_server: Use samba_server_gensec_start() in ldapsrv_backend_Init()

2020-09-07T12:02:15+00:00

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andreas Schneider

lib/util: remove extra safe_string.h file

2020-08-28T02:18:40+00:00

lib/util/safe_string.h is similar to source3/include/safe_string.h, but
the former has fewer checks. It is missing bcopy, strcasecmp, and
strncasecmp.

Add the missing elements to lib/util/safe_string.h remove the other
safe_string.h which is in the source3-specific path. To accomodate
existing uses of str(n?)casecmp, add #undef lines to source files where
they are used.

Signed-off-by: Matthew DeVore 
Reviewed-by: David Mulder 
Reviewed-by: Jeremy Allison 

Autobuild-User(master): Jeremy Allison 
Autobuild-Date(master): Fri Aug 28 02:18:40 UTC 2020 on sn-devel-184

ldap_server: Terminate LDAP connections on krb ticket expiry

2020-08-21T19:14:32+00:00

See RFC4511 section 4.4.1 and

https://lists.samba.org/archive/cifs-protocol/2020-August/003515.html

for details: Windows terminates LDAP connections when the krb5 ticket
expires, Samba should do the same. This patch slightly deviates from
Windows behaviour by sending a LDAP exop response with msgid 0 that is
ASN1-encoded conforming to RFC4511.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=14465

Signed-off-by: Volker Lendecke 
Reviewed-by: Stefan Metzmacher

ldap_server: Add the krb5 expiry to conn->limits

2020-08-21T19:14:32+00:00

Bug: https://bugzilla.samba.org/show_bug.cgi?id=14465

Signed-off-by: Volker Lendecke 
Reviewed-by: Stefan Metzmacher

ldap_server: Fix a typo

2020-08-17T19:35:37+00:00

Signed-off-by: Volker Lendecke 
Reviewed-by: Jeremy Allison

ldap_server: Do an early TALLOC_FREE()

2020-08-17T11:10:04+00:00

We don't need the asn1 struct after this point anymore

Signed-off-by: Volker Lendecke 
Reviewed-by: Andreas Schneider 

Autobuild-User(master): Volker Lendecke 
Autobuild-Date(master): Mon Aug 17 11:10:04 UTC 2020 on sn-devel-184

ldap_server: Avoid talloc_memdup() for ldap_decode()

2020-08-17T09:46:36+00:00

Slight optimization for the ldap server: We don't need to copy the
client PDU into the ASN1 struct, the decoding process happens
immediately in the same routine.

Signed-off-by: Volker Lendecke 
Reviewed-by: Andreas Schneider

s4 ldap_server: modernize debug calls

2020-05-06T21:15:42+00:00

Replace DEBUG(0 with DBG_ERR(

Signed-off-by: Gary Lockyer 
Reviewed-by: Volker Lendecke

CVE-2020-10704: libcli ldap_message: Add search size limits to ldap_decode

2020-05-04T02:59:32+00:00

Add search request size limits to ldap_decode calls.

The ldap server uses the smb.conf variable
"ldap max search request size" which defaults to 250Kb.
For cldap the limit is hard coded as 4096.

Credit to OSS-Fuzz

REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20454
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14334

Signed-off-by: Gary Lockyer 
Reviewed-by: Andrew Bartlett

CVE-2020-10704: S4 ldap server: Limit request sizes

2020-05-04T02:59:32+00:00

Check the size of authenticated and anonymous ldap requests and reject
them if they exceed the limits in smb.conf

Credit to OSS-Fuzz

REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20454
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14334

Signed-off-by: Gary Lockyer 
Reviewed-by: Andrew Bartlett