samba.git/source4/libcli/ldap/ldap_controls.c, branch talloc-2.4.4

dsdb: Prepare to handle smartcard password rollover

2024-06-10T04:27:30+00:00

We do this by allowing the password change control to indicate
that the password is to be randomised, bypassing the quality
checks (as true random passwords often fail these) and
re-randomising with the same code as is used for the KDC.

Signed-off-by: Andrew Bartlett 
Reviewed-by: Jo Sutton

s4:libcli: Add more controls to our list of known controls

2024-05-16T02:11:36+00:00

Signed-off-by: Jo Sutton 
Reviewed-by: Andrew Bartlett

s4:libcli: Fix code spelling

2024-05-16T02:11:36+00:00

Signed-off-by: Jo Sutton 
Reviewed-by: Andrew Bartlett

util/charset: Rename utf16_len_n() to utf16_null_terminated_len_n()

2023-11-15T22:07:36+00:00

The new name indicates that — contrary to functions such as strnlen() —
the length may include the terminator.

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett

s4:libcli: Remove trailing whitespace

2023-11-15T22:07:36+00:00

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett

s4:libcli: Check return value of convert_string_talloc() (CID 1272839)

2023-10-13T02:18:31+00:00

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett

s4:libcli: Remove unnecessary casts

2023-10-13T02:18:31+00:00

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett

CVE-2020-25720: s4-acl: Change behavior of Create Children check

2022-09-16T02:32:36+00:00

Up to now, the rights to modify an attribute were not checked during an LDAP
add operation. This means that even if a user has no right to modify
an attribute, they can still specify any value during object creation,
and the validated writes were not checked.
This patch changes this behavior. During an add operation,
a security descriptor is created that does not include the one provided by the
user, and is used to verify that the user has the right to modify the supplied attributes.
Exception is made for an object's mandatory attributes, and if the user has Write DACL right,
further checks are skipped.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14810

Pair-Programmed-With: Joseph Sutton 

Signed-off-by: Nadezhda Ivanova 
Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett

dsdb: Return dsdb_password_change control name to DSDB_CONTROL_PASSWORD_CHANGE_OLD_PW_CHECKED_OID

2022-03-17T01:57:38+00:00

This makes it clearer that the purpose of this control is to indicate that the password
was already checked (by an out-of-band mechanism, eg kpasswd) and so can safely be changed
subject to ACLs etc.

This essentially reverts bbb9dc806e4399c65dee9b5dc2cde0bfaa9609bd

Signed-off-by: Andrew Bartlett 
Reviewed-by: Stefan Metzmacher

CVE-2020-10704: lib util asn1: Add ASN.1 max tree depth

2020-05-04T02:59:31+00:00

Add maximum parse tree depth to the call to asn1_init, which will be
used to limit the depth of the ASN.1 parse tree.

Credit to OSS-Fuzz

REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20454
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14334

Signed-off-by: Gary Lockyer 
Reviewed-by: Andrew Bartlett