summaryrefslogtreecommitdiff
path: root/source3/auth
AgeCommit message (Collapse)AuthorFilesLines
2026-01-20auth: Avoid a memset with callocVolker Lendecke1-3/+1
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org>
2026-01-13source3/auth: Zero memory in auth_util.cPavel Filipenský1-10/+10
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2025-11-10auth: Simplify check_account()Volker Lendecke1-4/+1
We have strlower_talloc() for this Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org>
2025-06-20auth: Direct variable initializationVolker Lendecke1-9/+2
talloc_stackframe() panics on failure Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org> Autobuild-User(master): Anoop C S <anoopcs@samba.org> Autobuild-Date(master): Fri Jun 20 11:12:14 UTC 2025 on atb-devel-224
2025-06-20auth: Remove unused session_info_set_session_key()Volker Lendecke2-18/+0
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org>
2025-06-14s3:auth: Fix Coverity ID 1646934: memory leak in make_pw_chatShachar Sharon1-0/+3
make_pw_chat may succeed in the first call to SMB_CALLOC_ARRAY but fail in one of the following loop iterations, in which the list is already populated with dynamically allocated entries. Make sure that we free the list before bailing out with NULL. Fixes Coverity issue 1646934 Signed-off-by: Shachar Sharon <ssharon@redhat.com> Reviewed-by: Anoop C S <anoopcs@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org> Autobuild-User(master): Volker Lendecke <vl@samba.org> Autobuild-Date(master): Sat Jun 14 07:41:48 UTC 2025 on atb-devel-224
2025-05-15lib: Save lines by avoiding explicit ZERO_STRUCTP callsVolker Lendecke1-3/+1
SMB_CALLOC_ARRAY(..., 1) does this. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2025-04-03s3:auth: let auth_winbind pass WBC_AUTH_PARAM_FLAGS_FOR_NETLOGON if neededStefan Metzmacher1-0/+4
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2025-04-03s3:auth: remember make_auth3_context_for_netlogon() was usedStefan Metzmacher1-1/+8
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2025-02-27smbd: avoid work in unix token debug no-opDouglas Bagnall1-1/+7
When the debug level is too low to print, we don't need to allocate the strings. Bug: https://bugzilla.samba.org/show_bug.cgi?id=15737 Signed-off-by: Volker Lendecke <vl@samba.org> Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Pair-programmed-with: Volker Lendecke <vl@samba.org>
2025-01-15s3:auth: let check_sam_security() add NETLOGON_NTLMV2_ENABLEDStefan Metzmacher1-0/+2
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15783 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2024-09-20auth: Fix CID 1615191 Uninitialized scalar variableVolker Lendecke1-2/+4
Protect against winbind successfully returning 0 groups Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Noel Power <noel.power@suse.com> Autobuild-User(master): Volker Lendecke <vl@samba.org> Autobuild-Date(master): Fri Sep 20 18:25:54 UTC 2024 on atb-devel-224
2024-07-17s3:auth: allow real plaintext authenticationStefan Metzmacher1-1/+1
In standalone setups we use the PAM stack to verify the plaintext authentication, so we need to pass it down... There are still production systems out there (legacy audio/video recording systems...) using this. BUG: https://bugzilla.samba.org/show_bug.cgi?id=9705 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Wed Jul 17 11:17:54 UTC 2024 on atb-devel-224
2024-07-17s3:auth: let smb_pam_conv() handle resp=NULLStefan Metzmacher1-3/+10
pam_matrix calls smb_pam_conv() with resp=NULL in some situation, we should not segfault... BUG: https://bugzilla.samba.org/show_bug.cgi?id=9705 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2024-06-28s3:auth: Avoid passing freed pamh pointer to funcitons using itAndreas Schneider1-3/+7
"Error: USE_AFTER_FREE (CWE-416): samba-4.20.0rc2/source3/auth/pampass.c:466: freed_arg: ""pam_end"" frees ""pamh"". samba-4.20.0rc2/source3/auth/pampass.c:467: pass_freed_arg: Passing freed pointer ""pamh"" as an argument to ""smb_pam_error_handler"". 465| if( pamh != NULL ) { 466| pam_error = pam_end(pamh, 0); 467|-> if(smb_pam_error_handler(pamh, pam_error, ""End Cleanup Failed"", 2) == True) { 468| DEBUG(4, (""smb_pam_end: PAM: PAM_END OK.\n"")); 469| return True;" Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Noel Power <npower@samba.org>
2024-06-28s3:auth: Remove trailing spaces in pampass.cAndreas Schneider1-9/+9
Reviewed-by: Noel Power <npower@samba.org>
2024-05-14s3:gse: Implement gensec_gse_security_by_oid()Andreas Schneider1-1/+2
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-04-16lib: Give lib/util/util_file.c its own header fileVolker Lendecke1-0/+1
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Martin Schwenke <mschwenke@ddn.com>
2024-04-16s3:auth: Add support standalone server with MIT Keberos 1.21Andreas Schneider1-8/+66
This adds support for MIT Kerberos minimal PAC. Tickets from pure Kerberos realms with MIT Kerberos 1.21 or newer will always include a minimal PAC. The PAC include the checksum buffers and a logon_name PAC buffer. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-16s3:auth: Split auth3_generate_session_info_pac() into functionsAndreas Schneider1-159/+177
This gets rid of the multiple goto and just have a single destructor goto. Best view this commit with `git show -b <sha> --color-moved=zebra` Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-16s3:auth: Re-format auth3_generate_session_info_pac()Andreas Schneider1-39/+53
This is in preparation to split up the function into several functions. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-16s3:auth: Remove trailing spacesAndreas Schneider1-3/+3
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-03-27Revert "token_util.c: prefer capabilities over become_root"Björn Jacke1-2/+2
This reverts commit 944cb51506a94084d7ab52ee044fe6f66e1aaeb9. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15583 Signed-off-by: Bjoern Jacke <bjacke@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> Autobuild-User(master): Ralph Böhme <slow@samba.org> Autobuild-Date(master): Wed Mar 27 10:47:23 UTC 2024 on atb-devel-224
2024-03-27winbind: Log NOT_IMPLEMENTED as debugDavid Mulder1-1/+5
This message happens frequently when running a PDC/NT4 mode w/out winbind. Signed-off-by: David Mulder <dmulder@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Wed Mar 27 02:15:31 UTC 2024 on atb-devel-224
2023-12-01s3:auth: Allow 'Unix Users' and 'Unix Groups' to create a local tokenAndreas Schneider1-1/+16
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15469 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Fri Dec 1 08:06:44 UTC 2023 on atb-devel-224
2023-12-01s3:auth: Remove trailing white spaces from auth_util.cAndreas Schneider1-32/+32
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2023-11-16token_util.c: prefer capabilities over become_rootBjörn Jacke1-2/+2
Signed-off-by: Bjoern Jacke <bjacke@samba.org> Reviewed-by: Christof Schmitt <cs@samba.org>
2023-10-25s3:auth: Add missing word to commentJoseph Sutton1-1/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-10-11libcli: Make debug_unix_user_token() use just one DEBUG statementVolker Lendecke1-9/+22
This avoids messing up the debug logs when multiple processes are writing into the same file. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Wed Oct 11 00:24:58 UTC 2023 on atb-devel-224
2023-09-26libcli/security: Pass in claims evaluation state when building any security ↵Andrew Bartlett1-4/+23
token Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2023-09-11s3:auth: Fix code spellingJoseph Sutton1-1/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-08s3:auth: Add missing newlines to logging messagesJoseph Sutton3-4/+4
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-07-05s3:auth: Use new debug macros for loggingAndreas Schneider1-6/+12
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-07-05s3:auth: Fix code spellingAndreas Schneider9-35/+35
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-06-25auth: Add functionality to log client and server policy informationJoseph Sutton2-3/+9
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-05-16auth: Return status code if configuration prohibits NTLMJoseph Sutton1-0/+1
Currently, we rely on ‘stored_nt’ being NULL to give an NT_STATUS_WRONG_PASSWORD error. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-02-08auth: Shorten long SID flags combinationsJoseph Sutton2-6/+4
The combination MANDATORY | ENABLED_BY_DEFAULT | ENABLED is very commonly used, and introducing a shorter alias for it makes the code clearer. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-02-08s4:kdc: Add resource SID compressionJoseph Sutton1-1/+2
The domain-local groups that are added to the PAC of a service ticket are now, if the service doesn't disclaim support for SID compression, placed into the resource groups structure in PAC_LOGON_INFO. In a TGS exchange directed to a KDC, rather than to a service, the resource groups structure is simply copied into the updated PAC without any processing being done. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-02-08auth: Pass through entire PAC flags value in auth_user_infoJoseph Sutton1-1/+1
Besides the NETLOGON_GUEST bit indicating whether the user has been authenticated, we now carry all of the other bits as well. This lets us match Windows' behaviour of simply passing these bits through to an updated PAC when processing a TGS-REQ. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-02-08auth: Exclude resource groups from a TGTJoseph Sutton1-0/+1
Resource group SIDs should only be placed into a service ticket, but we were including them in all tickets. Now that we have access to the group attributes, we'll filter out any groups with SE_GROUP_RESOURCE set if we're creating a TGT. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-02-08auth: Store group attributes in auth_user_info_dcJoseph Sutton2-19/+22
Group expansion, performed in dsdb_expand_nested_groups(), now incorporates a check of the type of each group. Those that are resource groups receive the SE_GROUP_RESOURCE bit in the attributes which are now carried alongside each group SID. Whereas before, in auth_convert_user_info_dc_sambaseinfo() and auth_convert_user_info_dc_saminfo6(), we invariantly used the flag combination SE_GROUP_MANDATORY | SE_GROUP_ENABLED_BY_DEFAULT | SE_GROUP_ENABLED to set attributes in the PAC, we now take the correct attributes from user_info_dc. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-01-19s3:auth: call wbcFreeMemory(info) in auth3_generate_session_info_pac()Stefan Metzmacher1-0/+1
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15286 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2023-01-10lib: Remove idtree from samba_util.hVolker Lendecke1-0/+1
No need to recompile the world when only a few files need this. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2022-12-12lib: Remove fstring_sub() that was used just onceVolker Lendecke1-1/+1
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2022-10-13s3:auth_samba4: make use of imessaging_init_discard_incoming()Stefan Metzmacher1-4/+4
Otherwise we'll generate a memory leak of imessaging_post_state/ tevent_immediate structures per incoming message! BUG: https://bugzilla.samba.org/show_bug.cgi?id=15201 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2022-09-16s3:auth: Flush the GETPWSID in memory cache for NTLM authAndreas Schneider1-2/+6
Example valgrind output: ==22502== 22,747,002 bytes in 21,049 blocks are possibly lost in loss record 1,075 of 1,075 ==22502== at 0x4C29F73: malloc (vg_replace_malloc.c:309) ==22502== by 0x11D7089C: _talloc_pooled_object (in /usr/lib64/libtalloc.so.2.1.16) ==22502== by 0x9027834: tcopy_passwd (in /usr/lib64/libsmbconf.so.0) ==22502== by 0x6A1E1A3: pdb_copy_sam_account (in /usr/lib64/libsamba-passdb.so.0.27.2) ==22502== by 0x6A28AB7: pdb_getsampwnam (in /usr/lib64/libsamba-passdb.so.0.27.2) ==22502== by 0x65D0BC4: check_sam_security (in /usr/lib64/samba/libauth-samba4.so) ==22502== by 0x65C70F0: ??? (in /usr/lib64/samba/libauth-samba4.so) ==22502== by 0x65C781A: auth_check_ntlm_password (in /usr/lib64/samba/libauth-samba4.so) ==22502== by 0x14E464: ??? (in /usr/sbin/winbindd) ==22502== by 0x151CED: winbind_dual_SamLogon (in /usr/sbin/winbindd) ==22502== by 0x152072: winbindd_dual_pam_auth_crap (in /usr/sbin/winbindd) ==22502== by 0x167DE0: ??? (in /usr/sbin/winbindd) ==22502== by 0x12F29B12: tevent_common_invoke_fd_handler (in /usr/lib64/libtevent.so.0.9.39) ==22502== by 0x12F30086: ??? (in /usr/lib64/libtevent.so.0.9.39) ==22502== by 0x12F2E056: ??? (in /usr/lib64/libtevent.so.0.9.39) ==22502== by 0x12F2925C: _tevent_loop_once (in /usr/lib64/libtevent.so.0.9.39) ==22502== by 0x16A243: ??? (in /usr/sbin/winbindd) ==22502== by 0x16AA04: ??? (in /usr/sbin/winbindd) ==22502== by 0x12F29F68: tevent_common_invoke_immediate_handler (in /usr/lib64/libtevent.so.0.9.39) ==22502== by 0x12F29F8F: tevent_common_loop_immediate (in /usr/lib64/libtevent.so.0.9.39) ==22502== by 0x12F2FE3C: ??? (in /usr/lib64/libtevent.so.0.9.39) ==22502== by 0x12F2E056: ??? (in /usr/lib64/libtevent.so.0.9.39) ==22502== by 0x12F2925C: _tevent_loop_once (in /usr/lib64/libtevent.so.0.9.39) ==22502== by 0x12F4C7: main (in /usr/sbin/winbindd) You can find one for each string in pdb_copy_sam_account(), in total this already has 67 MB in total for this valgrind run. pdb_getsampwnam() -> memcache_add_talloc(NULL, PDB_GETPWSID_CACHE, ...) BUG: https://bugzilla.samba.org/show_bug.cgi?id=15169 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Fri Sep 16 20:30:31 UTC 2022 on sn-devel-184
2022-09-12CVE-2021-20251 s3: ensure bad password count atomic updatesJeremy Allison1-0/+77
The bad password count is supposed to limit the number of failed login attempt a user can make before being temporarily locked out, but race conditions between processes have allowed determined attackers to make many more than the specified number of attempts. This is especially bad on constrained or overcommitted hardware. To fix this, once a bad password is detected, we reload the sam account information under a user-specific mutex, ensuring we have an up to date bad password count. Discovered by Nathaniel W. Turner. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611 Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-08-26s3:auth: Zero memory in sam_password_ok()Pavel Filipenský1-4/+10
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2022-08-08lib/util/access: source3/auth/user_util: Check for INNETGRlistout1-2/+2
Checking for presence of both netgroup and innetgr. INNETGR is not defined on libc's such as musl so not checking results in a build error. Signed-off-by: listout <brahmajit.xyz@gmail.com> Reviewed-by: Andreas Schneider <asn@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org> Autobuild-User(master): Volker Lendecke <vl@samba.org> Autobuild-Date(master): Mon Aug 8 07:28:31 UTC 2022 on sn-devel-184
2022-06-09s3:smbd: Free allocated strings before leaving user_in_netgroup() functionSamuel Cabrero1-0/+3
Signed-off-by: Samuel Cabrero <scabrero@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Thu Jun 9 22:40:43 UTC 2022 on sn-devel-184
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-06 19:02:26 +0000