samba.git/source4/rpc_server/common, branch master

s4:rpc_server/common: make use of dcesrv_async_reply()

2023-10-17T19:20:38+00:00

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett

s4:rpc_server: Fix code spelling

2023-08-14T21:45:29+00:00

Signed-off-by: Andreas Schneider 
Reviewed-by: Andrew Bartlett

CVE-2022-32743 s4:rpc_server/common: Add dcesrv_samdb_connect_session_info()

2022-07-28T22:47:38+00:00

This function allows us to connect to samdb as a particular user by
passing in that user's session info.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14833

Signed-off-by: Joseph Sutton 
Reviewed-by: Douglas Bagnall

CVE-2021-3738 s4:rpc_server/common: provide assoc_group aware dcesrv_samdb_connect_as_{system,user}() helpers

2021-11-09T19:45:34+00:00

We already had dcesrv_samdb_connect_as_system(), but it uses the per
connection memory of auth_session_info and remote_address.

But in order to use the samdb connection on a per association group
context/policy handle, we need to make copies, which last for the
whole lifetime of the 'samdb' context.

We need the same logic also for all cases we make use of
the almost same logic where we want to create a samdb context
on behalf of the authenticated user (without allowing system access),
so we introduce dcesrv_samdb_connect_as_user().

In the end we need to replace all direct callers to samdb_connect()
from source4/rpc_server.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14468

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett

CVE-2020-25718 dsdb: Bring sid_helper.c into common code as rodc_helper.c

2021-11-09T19:45:34+00:00

These common routines will assist the KDC to do the same access
checking as the RPC servers need to do regarding which accounts
a RODC can act with regard to.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14558

Signed-off-by: Andrew Bartlett 
Reviewed-by: Joseph Sutton

CVE-2020-25718 s4-rpc_server: Add in debug messages into RODC processing

2021-11-09T19:45:34+00:00

These are added for the uncommon cases.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14558

Signed-off-by: Andrew Bartlett 
Reviewed-by: Joseph Sutton

CVE-2020-25718 s4-rpc_server: Provide wrapper samdb_confirm_rodc_allowed_to_repl_to()

2021-11-09T19:45:34+00:00

This shares the lookup of the tokenGroups attribute.

There will be a new caller that does not want to do this step,
so this is a wrapper of samdb_confirm_rodc_allowed_to_repl_to_sid_list()
rather than part of it

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14558

Signed-off-by: Andrew Bartlett 
Reviewed-by: Joseph Sutton

CVE-2020-25718 s4-rpc_server: Confirm that the RODC has the UF_PARTIAL_SECRETS_ACCOUNT bit

2021-11-09T19:45:34+00:00

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14558

Signed-off-by: Andrew Bartlett 
Reviewed-by: Joseph Sutton

CVE-2020-25718 s4-rpc_server: Put msDS-KrbTgtLinkBL and UF_INTERDOMAIN_TRUST_ACCOUNT RODC checks in common

2021-11-09T19:45:34+00:00

While these checks were not in the NETLOGON case, there is no sense where
an RODC should be resetting a bad password count on either a
UF_INTERDOMAIN_TRUST_ACCOUNT nor a RODC krbtgt account.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14558

Signed-off-by: Andrew Bartlett 
Reviewed-by: Joseph Sutton

CVE-2020-25718 s4-rpc_server: Put RODC reveal/never reveal logic into a single helper function

2021-11-09T19:45:34+00:00

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14558

Signed-off-by: Andrew Bartlett 
Reviewed-by: Joseph Sutton