summaryrefslogtreecommitdiff
path: root/source4/libcli/ldap
AgeCommit message (Collapse)AuthorFilesLines
2026-01-15ldb: add "policy hints" controls to be used by password_hash moduleDouglas Bagnall1-0/+72
These won't have any effect yet, but soon they will allow a privileged account to perform a password reset that respects constraints on password history, age, and length, as if the reset was an ordinary password change (that is, where the user provides the old password). A normal user can't reset their own password using this, if the organisation is using a remote service (e.g. Entra ID or Keycloak) to manage passwords, that service can use a policy hints control to ensure it follows AD password policy. Entra ID Self Service Password Reset (SSPR) uses the deprecated OID. BUG: https://bugzilla.samba.org/show_bug.cgi?id=12020 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2026-01-07lib: Don't call a function to initialize an empty DATA_BLOBVolker Lendecke1-2/+2
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org>
2024-06-10dsdb: Prepare to handle smartcard password rolloverAndrew Bartlett1-0/+1
We do this by allowing the password change control to indicate that the password is to be randomised, bypassing the quality checks (as true random passwords often fail these) and re-randomising with the same code as is used for the KDC. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jo Sutton <josutton@catalyst.net.nz>
2024-05-16s4:libcli: Add more controls to our list of known controlsJo Sutton1-0/+20
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-05-16s4:libcli: Fix code spellingJo Sutton1-2/+2
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-23s4:libcli/ldap: add support for ADS_AUTH_SASL_{STARTTLS,LDAPS}Stefan Metzmacher2-4/+89
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-23s4:libcli/ldap: add tls channel binding support for ldap_bind_sasl()Stefan Metzmacher1-0/+53
We still allow 'ldap_testing:tls_channel_bindings = no' and 'ldap_testing:channel_bound = no' for testing the old behavior in order to have expected failures in our tests. And we have 'ldap_testing:forced_channel_binding = somestring' in order to force invalid bindings. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15621 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-23s4:libcli/ldap: make use of tstream_tls_params_client_lpcfg()Stefan Metzmacher1-12/+4
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15621 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-23s4:libcli/ldap: force GSS-SPNEGO in ldap_bind_sasl()Stefan Metzmacher1-50/+7
There's no point in asking the server for supportedSASLMechanisms, every server (we care about) supports GSS-SPNEGO. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15621 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-23s4:libcli/ldap: fix no memory error code in ldap_bind_sasl()Stefan Metzmacher1-1/+4
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15621 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-23s4:libcli/ldap: ldap4_new_connection() requires a valid lp_ctxStefan Metzmacher1-0/+4
Otherwise we'll crash in a lot of places later. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-11-15util/charset: Rename utf16_len_n() to utf16_null_terminated_len_n()Joseph Sutton1-1/+1
The new name indicates that — contrary to functions such as strnlen() — the length may include the terminator. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-11-15s4:libcli: Remove trailing whitespaceJoseph Sutton1-27/+26
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-10-13s4:libcli: Check return value of convert_string_talloc() (CID 1272839)Joseph Sutton1-3/+8
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-10-13s4:libcli: Remove unnecessary castsJoseph Sutton1-14/+14
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-14s4:libcli: Fix code spellingAndreas Schneider2-2/+2
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-08s4:libcli/ldap: Fix code spellingJoseph Sutton1-1/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-12-16s3-librpc: add ads.idl and convert ads_struct to talloc.Günther Deschner1-0/+1
Guenther Signed-off-by: Guenther Deschner <gd@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2022-09-16CVE-2020-25720: s4-acl: Change behavior of Create Children checkNadezhda Ivanova1-0/+1
Up to now, the rights to modify an attribute were not checked during an LDAP add operation. This means that even if a user has no right to modify an attribute, they can still specify any value during object creation, and the validated writes were not checked. This patch changes this behavior. During an add operation, a security descriptor is created that does not include the one provided by the user, and is used to verify that the user has the right to modify the supplied attributes. Exception is made for an object's mandatory attributes, and if the user has Write DACL right, further checks are skipped. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14810 Pair-Programmed-With: Joseph Sutton <josephsutton@catalyst.net.nz> Signed-off-by: Nadezhda Ivanova <nivanova@symas.com> Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-03-17dsdb: Return dsdb_password_change control name to ↵Andrew Bartlett1-1/+1
DSDB_CONTROL_PASSWORD_CHANGE_OLD_PW_CHECKED_OID This makes it clearer that the purpose of this control is to indicate that the password was already checked (by an out-of-band mechanism, eg kpasswd) and so can safely be changed subject to ACLs etc. This essentially reverts bbb9dc806e4399c65dee9b5dc2cde0bfaa9609bd Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2021-04-28auth:creds: Add obtained arg to cli_credentials_set_gensec_features()Andreas Schneider1-2/+6
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-07-02ldap_client: Make ldap_parse_basic_url() IPv6-address awareVolker Lendecke1-0/+27
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org> Autobuild-User(master): Volker Lendecke <vl@samba.org> Autobuild-Date(master): Thu Jul 2 12:01:06 UTC 2020 on sn-devel-184
2020-07-02ldap_client: Align integer typesVolker Lendecke1-3/+3
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org>
2020-07-02ldap_client: Make ldap_parse_basic_url take care of ldapi as wellVolker Lendecke1-67/+80
SUSV4's sscanf has the %m modifier, which allocates the right amount. Remove those SMB_ASSERTS for string buffers. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org>
2020-05-04CVE-2020-10704: libcli ldap_message: Add search size limits to ldap_decodeGary Lockyer1-1/+2
Add search request size limits to ldap_decode calls. The ldap server uses the smb.conf variable "ldap max search request size" which defaults to 250Kb. For cldap the limit is hard coded as 4096. Credit to OSS-Fuzz REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20454 BUG: https://bugzilla.samba.org/show_bug.cgi?id=14334 Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-05-04CVE-2020-10704: lib util asn1: Add ASN.1 max tree depthGary Lockyer2-25/+25
Add maximum parse tree depth to the call to asn1_init, which will be used to limit the depth of the ASN.1 parse tree. Credit to OSS-Fuzz REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20454 BUG: https://bugzilla.samba.org/show_bug.cgi?id=14334 Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-07-16s4/libcli/ldab: clang: Fix 'Access results in a deref of a null pointer'Noel Power1-1/+1
Fixes: source4/libcli/ldap/ldap_client.c:1023:6: warning: Access to field 'type' results in a dereference of a null pointer <--[clang] if ((*msg)->type != type) { ^~~~~~~~~~~~ Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2019-05-22libcli/ldap: Remove unsued ldap_transaction()Andrew Bartlett1-23/+0
This is unsued since a87dea2a0894015cf4a3140995791f5468c40038 in 2007 when we moved to using LDB for LDAP in this area of the code. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2018-05-10samdb: Add transaction id controlGary Lockyer1-0/+1
Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-03-13CVE-2018-1057: s4:dsdb/samdb: define ↵Ralph Boehme1-0/+1
DSDB_CONTROL_PASSWORD_ACL_VALIDATION_OID control Will be used to pass "user password change" vs "password reset" from the ACL to the password_hash module, ensuring both modules treat the request identical. Bug: https://bugzilla.samba.org/show_bug.cgi?id=13272 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2018-02-27libsocket: Add "mem_ctx" to socket_create()Volker Lendecke1-2/+3
Every caller did a talloc_steal() after socket_create(). Just pass in the correct memory context. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2018-02-22util/rfc1738_unescape(): return end pointer or NULL on errorDouglas Bagnall1-4/+7
At present we don't detect errors, but when we do we'll return NULL. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-05-22s4:libcli/ldap: just use gensec_update() in ldap_bind_sasl()Stefan Metzmacher1-2/+1
We're in a blocking/sync call, we should avoid using nested event loops for this. As far as I can see ldap_bind_sasl() is only called from command line tools, which are ok to block. Resolving this requires also resolving the general case in LDB, as that is the API this is used from. We would need ldb_connect_send() and ldb_connect_recv() at a start. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Mon May 22 01:12:23 CEST 2017 on sn-devel-144
2016-05-06typo: mplementation => implementationGarming Sam4-4/+4
Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2016-04-12CVE-2016-2113: s4:libcli/ldap: verify the server certificate and hostname if ↵Stefan Metzmacher1-7/+4
configured BUG: https://bugzilla.samba.org/show_bug.cgi?id=11752 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Günther Deschner <gd@samba.org>
2016-04-12CVE-2016-2113: s4:lib/tls: implement infrastructure to do peer verificationStefan Metzmacher1-0/+2
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11752 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Günther Deschner <gd@samba.org>
2016-04-12CVE-2016-2112: s4:libcli/ldap: auto upgrade to SIGN after STRONG_AUTH_REQUIREDStefan Metzmacher1-0/+7
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11644 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Günther Deschner <gd@samba.org>
2016-04-12CVE-2016-2112: s4:libcli/ldap: make sure we detect downgrade attacksStefan Metzmacher1-0/+14
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11644 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Günther Deschner <gd@samba.org>
2016-04-12CVE-2016-2112: s4:libcli/ldap: honour "client ldap sasl wrapping" optionStefan Metzmacher1-4/+26
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11644 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Günther Deschner <gd@samba.org>
2016-03-10s4:libcli/ldap: fix retry authentication after a bad passwordStefan Metzmacher1-2/+2
We need to start with an empty input buffer. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Günther Deschner <gd@samba.org>
2016-03-10s4:libcli/ldap: make use of GENSEC_FEATURE_LDAP_STYLEStefan Metzmacher1-0/+7
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Günther Deschner <gd@samba.org>
2016-03-09ldap VLV: correct ASN1 parsing of VLV requestsGarming Sam1-20/+5
As with the encoding, the ASN1_CONTEXT tag isn't followed by an ASN1_SEQUENCE, though you wouldn't think that from reading the specification. Pair-programmed-with: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-03-09ldap: fix search control rule identifiers ASN.1 typeGarming Sam1-1/+2
Wireshark and Windows both expect matching rule identifiers to be given the ContextSimple type identifier instead of the Octet String. As far as we can tell this is not formally specified anywhere. Pair-programmed-with: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-03-09ldap VLV: memdup, not strdup VLV context_idDouglas Bagnall1-1/+1
The context ID is not a text string, it is an opaque binary field. Pair-programmed-with: Garming Sam <garming@catalyst.net.nz> Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-03-09ldap VLV: use correct ASN.1 encoding for requestsGarming Sam1-11/+3
The search reference points (either an integer index or a string for comparison) are supposed to use ASN1_CONTEXT or ASN1_CONTEXT_SIMPLE (respectively) ASN.1 types. We were using these types, but we also put extra ones in too, which nobody else likes. Pair-programmed-with: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-02-19s4-libcli: Add missing ldb headerAndreas Schneider2-1/+4
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2016-02-17s4:libcli/ldap: add support for LDB_CONTROL_DIRSYNC_EX_OIDStefan Metzmacher1-0/+1
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-02-17s4:libcli/ldap: send AbandonRequests for cancelled requestsStefan Metzmacher1-0/+50
This happens on a local timeout of an talloc_free() of the request. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-01-13libcli: Fix a typoVolker Lendecke1-1/+1
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Uri Simchoni <uri@samba.org>
2016-01-13Rename 'errors' to 'samba-errors' and make it public.Jelmer Vernooij1-1/+1
This is necessary because it has public headers. Signed-off-by: Jelmer Vernooij <jelmer@jelmer.uk> Reviewed-By: Andrew Bartlett <abartlet@samba.org> Reviewed-By: Stefan Metzmacher <metze@samba.org> Autobuild-User(master): Jelmer Vernooij <jelmer@samba.org> Autobuild-Date(master): Wed Jan 13 07:47:04 CET 2016 on sn-devel-144
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-06 21:25:52 +0000