summaryrefslogtreecommitdiff
path: root/source4/nbt_server
AgeCommit message (Collapse)AuthorFilesLines
2025-10-21CVE-2025-10230: s4:wins: restrict names fed to shellDouglas Bagnall1-0/+9
If the "wins hook" smb.conf parameter is set, the WINS server will attempt to execute that value in a shell command line when a client asks to modify a name. The WINS system is a trusting one, and clients can claim any NETBIOS name they wish. With the source3 nmbd WINS server (since the 1999 commit now called 3db52feb1f3b2c07ce0b06ad4a7099fa6efe3fc7) the wins hook will not be run for names that contain shell metacharacters. This restriction has not been present on the source4 nbt WINS server, which is the WINS server that will be used in the event that an Active Directory Domain Controller is also running WINS. This allowed an unauthenticated client to execute arbitrary commands on the server. This commit brings the nmbd check into the nbt WINS server, so that the wins hook will only be run for names that contain only letters, digits, hyphens, underscores and periods. This matches the behaviour described in the smb.conf man page. The source3 nmbd WINS server has another layer of protection, in that it uses the smb_run() exec wrapper that tries to escape arguments. We don't do that here. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15903 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org> Autobuild-Date(master): Tue Oct 21 19:43:25 UTC 2025 on atb-devel-224
2024-04-10s4:wins: use NUMERIC_CMP in nbtd_wins_randomize1Clist_sort()Douglas Bagnall1-1/+2
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15625 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-10s4:wins: winsdb_addr_sort_list() uses NUMERIC_CMP()Douglas Bagnall1-1/+1
expire_time is time_t, which is at least int-sized, so overflow is possible (if this code ever runs). BUG: https://bugzilla.samba.org/show_bug.cgi?id=15625 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-10s4:wins: use NUMERIC_CMP in winsdb_addr_sort_list()Douglas Bagnall1-1/+2
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15625 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-05s4:nbt_server: simulate nmbd and provide unexpected handlingStefan Metzmacher5-3/+229
This is needed in order to let nbt_getdc() work against another AD DC and get back a modern response with DNS based names. Instead of falling back to the ugly name_status_find() that simulates just an NETLOGON_SAM_LOGON_RESPONSE_NT40 response. This way dsgetdcname() can work with just the netbios domain name given and still return an active directory response. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15620 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-07-07librpc/nbt: Avoid reading invalid member of unionJoseph Sutton1-1/+1
WACK packets use the ‘data’ member of the ‘nbt_rdata’ union, but they claim to be a different type — NBT_QTYPE_NETBIOS — than would normally be used with that union member. This means that if rr_type is equal to NBT_QTYPE_NETBIOS, ndr_push_nbt_res_rec() has to guess which type the structure really is by examining the data member. However, if the structure is actually of a different type, that union member will not be valid and accessing it will invoke undefined behaviour. To fix this, eliminate all the guesswork and introduce a new type, NBT_QTYPE_WACK, which can never appear on the wire, and which indicates that although the ‘data’ union member should be used, the wire type is actually NBT_QTYPE_NETBIOS. This means that as far as NDR is concerned, the ‘netbios’ member of the ‘nbt_rdata’ union will consistently be used for all NBT_QTYPE_NETBIOS structures; we shall no longer access the wrong member of the union. Credit to OSS-Fuzz. REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38480 BUG: https://bugzilla.samba.org/show_bug.cgi?id=15019 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org> Autobuild-Date(master): Fri Jul 7 01:14:06 UTC 2023 on atb-devel-224
2023-01-10lib: Remove idtree from samba_util.hVolker Lendecke1-1/+1
No need to recompile the world when only a few files need this. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2022-07-27CVE-2022-32746 ldb: Make use of functions for appending to an ldb_messageJoseph Sutton1-8/+5
This aims to minimise usage of the error-prone pattern of searching for a just-added message element in order to make modifications to it (and potentially finding the wrong element). BUG: https://bugzilla.samba.org/show_bug.cgi?id=15009 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2020-11-27s4: rename source4/smbd/ to source4/samba/Ralph Boehme13-15/+15
Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Ralph Böhme <slow@samba.org> Autobuild-Date(master): Fri Nov 27 10:07:18 UTC 2020 on sn-devel-184
2020-08-28lib/util: remove extra safe_string.h fileMatthew DeVore1-0/+2
lib/util/safe_string.h is similar to source3/include/safe_string.h, but the former has fewer checks. It is missing bcopy, strcasecmp, and strncasecmp. Add the missing elements to lib/util/safe_string.h remove the other safe_string.h which is in the source3-specific path. To accomodate existing uses of str(n?)casecmp, add #undef lines to source files where they are used. Signed-off-by: Matthew DeVore <matvore@google.com> Reviewed-by: David Mulder <dmulder@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Fri Aug 28 02:18:40 UTC 2020 on sn-devel-184
2020-08-03lib: relicense smb_strtoul(l) under LGPLv3Ralph Boehme1-0/+1
Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Swen Schillig <swen@linux.ibm.com> Reviewed-by: Volker Lendecke <vl@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Mon Aug 3 22:21:04 UTC 2020 on sn-devel-184
2019-11-27smbdotconf: mark "wins hook" with substitution="1"Ralph Boehme1-1/+3
Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2019-06-30source4: Update all consumers of strtoul_err(), strtoull_err() to new APISwen Schillig1-2/+3
Signed-off-by: Swen Schillig <swen@linux.ibm.com> Reviewed-by: Ralph Boehme <slow@samba.org> Reviewed-by: Christof Schmitt <cs@samba.org>
2019-03-01source4: Use wrapper for string to integer conversionSwen Schillig1-1/+11
In order to detect an value overflow error during the string to integer conversion with strtoul/strtoull, the errno variable must be set to zero before the execution and checked after the conversion is performed. This is achieved by using the wrapper function strtoul_err and strtoull_err. Signed-off-by: Swen Schillig <swen@linux.ibm.com> Reviewed-by: Ralph Böhme <slow@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2018-11-02nbt_server: Use dom_sid_str_bufVolker Lendecke1-4/+6
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2018-11-01source4 smdb: Add a post fork hook to the service APIGary Lockyer1-9/+13
Add a post fork hook to the service API this will be called: - standard process model immediately after the task_init. - single process model immediately after the task_init - prefork process model, inhibit_pre_fork = true immediately after the task_init - prefork process model, inhibit_pre_fork = false after each service worker has forked. It is not run on the service master process. The post fork hook is not called in the standard model if a new process is forked on a new connection. It is instead called immediately after the task_init. The task_init hook has been changed to return an error code. This ensures the post_fork code is only run if the task_init code completed successfully. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
2018-11-01source4 smbd: Make the service_details structure constant.Gary Lockyer1-1/+1
Make the service_details structure a static const. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
2018-05-10samdb: Add remote address to connectGary Lockyer1-1/+6
Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-04-18nbt_server: Align integer typesVolker Lendecke1-1/+1
sizeof returns size_t Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Autobuild-User(master): Volker Lendecke <vl@samba.org> Autobuild-Date(master): Wed Apr 18 00:11:51 CEST 2018 on sn-devel-144
2018-04-17nbt_server: Factor out nbtd_node_status_reply_packetVolker Lendecke1-45/+101
Separate packet creation from sending out the packet. This way packet creation can be used elsewhere in the future. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2018-04-17nbt_server: Factor out nbtd_name_query_reply_packetVolker Lendecke1-34/+78
Separate packet creation from sending out the packet. This way packet creation can be used elsewhere in the future. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2018-02-27nbt_server: Factor out packet generation for netlogon replyVolker Lendecke1-54/+102
This also fixes an inaccuracy (or even a bug?): The previous code pulled the reply mailslot always through req.logon.mailslot_name, which is the union for LOGON_SAM_LOGON_REQUESTs. The LOGON_PRIMARY_QUERY must be referenced by req.pdc.mailslot_name. It might have worked by chance, but this should be more correct. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Tue Feb 27 14:10:14 CET 2018 on sn-devel-144
2018-02-27nbt_server: nbtd_netlogon_getdc doesn't need "src"Volker Lendecke1-2/+1
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2018-02-27nbt_server: Avoid a talloc callVolker Lendecke1-2/+4
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2018-02-27nbt_server: Avoid an "else" branchVolker Lendecke1-4/+2
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2018-02-27nbt_server: nbtd_netlogon_samlogon needs the dst_name, not the packetVolker Lendecke1-8/+11
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2018-02-27nbt_server: nbtd_netlogon_getdc needs just the dst_nameVolker Lendecke1-6/+8
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2018-02-27nbt_server: Fix a typo ("domian->domain")Volker Lendecke1-1/+2
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2018-02-27nbt_server: nbtd_netlogon_samlogon needs the nbtsrv, not the intefaceVolker Lendecke1-5/+5
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2018-02-27nbt_server: nbtd_netlogon_getdc needs the nbtsrv, not the interfaceVolker Lendecke1-8/+8
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2018-02-27nbt_server: Centralize a consistency checkVolker Lendecke1-8/+7
This is a "should NEVER happen" and applies to both LOGON_PRIMARY_QUERY and LOGON_SAM_LOGON_REQUEST Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2018-02-27nbt_server: Make nbtd_mailslot_netlogon_handler a bit more idiomaticVolker Lendecke1-3/+5
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2018-02-27nbt_server: Factor out dgram sending from reply constructionVolker Lendecke1-42/+76
Separation of concerns. Only one call to dgram_mailslot_netlogon_reply, which does the UDP send. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2018-02-27nbt_server: Remove a pointless assignmentVolker Lendecke1-2/+0
I don't see how data.msg.dest_name.type is accessed further down dgram_mailslot_netlogon_reply only accesses packet->src_addr, packet->src_port and packet->data.msg.source_name, *not* data.msg.dest_name. Also, "packet" is thrown away after this call. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2018-02-27nbt_server: Remove some unused parametersVolker Lendecke1-8/+4
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2018-02-27libdgram: Remove an unused parameterVolker Lendecke1-1/+1
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2018-02-27libdgram: Remove an unused parameterVolker Lendecke1-1/+2
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2018-02-13nbt_server: Fix a typoVolker Lendecke1-1/+1
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2017-10-19 source4/smbd: refactor the process model for preforkGary Lockyer1-1/+5
Refactor the process model code to allow the addition of a prefork process model. - Add a process context to contain process model specific state - Add a service details structure to allow service to indicate which process model options they can support. In the new code the services advertise the features they support to the process model. The process model context is plumbed through to allow the process model to keep track of the supported options, and any state the process model may require. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2017-05-11s4: Add TALLOC_CTX * to register_server_service().Jeremy Allison1-1/+1
Use the passed in context from callers. Remove one talloc_autofree_context(). Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2017-04-22lib: modules: Change XXX_init interface from XXX_init(void) to ↵Jeremy Allison1-2/+2
XXX_init(TALLOC_CTX *) Not currently used - no logic changes inside. This will make it possible to pass down a long-lived talloc context from the loading function for modules to use instead of having them internally all use talloc_autofree_context() which is a hidden global. Updated all known module interface numbers, and added a WHATSNEW. Signed-off-by: Jeremy Allison <jra@samba.org> Signed-off-by: Ralph Böhme <slow@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Sat Apr 22 01:17:00 CEST 2017 on sn-devel-144
2016-02-06dlist: remove unneeded type argument from DLIST_ADD_END()Michael Adam2-2/+2
Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2016-01-13Avoid including libds/common/roles.h in public loadparm.h header.Jelmer Vernooij2-0/+2
Signed-Off-By: Jelmer Vernooij <jelmer@samba.org> Reviewed-By: Andrew Bartlett <abartlet@samba.org> Reviewed-By: Stefan Metzmacher <metze@samba.org>
2015-06-19Fix a typoVolker Lendecke1-1/+1
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Ira Cooper <ira@samba.org> Autobuild-User(master): Volker Lendecke <vl@samba.org> Autobuild-Date(master): Fri Jun 19 01:05:17 CEST 2015 on sn-devel-104
2014-11-25s4:nbt_server: avoid str_list related const warningStefan Metzmacher1-1/+3
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2014-05-13s4:nbt_server/wins: make use explicit use of the top level event contextAndrew Bartlett1-2/+2
Andrew Bartlett Change-Id: I4b8e5c16bd03a038da6527cfb4c91fc874626b18 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2014-02-20lib/param: handle non-constant strings properly by passing in a memory contextGarming Sam1-1/+1
Signed-off-by: Garming Sam <garming@catalyst.net.nz> Change-Id: Ic6bb1c709defd2b0f35fc7b877da0badca385776 Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Nadezhda Ivanova <nivanova@samba.org>
2013-11-11s4:dsdb: Move cldap netlogon functions into samdb/ldb_modulesBenjamin Franzke2-2/+2
As netlogon is handled by the samdb now, the corresponding functions should live there as well. Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Nadezhda Ivanova <nivanova@symas.com>
2013-08-12s4:nbt_server: avoid talloc_reference()Stefan Metzmacher3-5/+6
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-02-17s4-nbt: Ensure source4/ nbt client and server honour 'disable netbios'Andrew Bartlett1-0/+5
Reviewed-by: Stefan Metzmacher <metze@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Sun Feb 17 11:25:34 CET 2013 on sn-devel-104
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-07 07:44:19 +0000